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CRM 

Hard  lessons  learned  from  the 
upgrade  that  cost  AT&T  Wireless 
$100  million  in  lost  revenue 

Page  56 


Great  Moments  at  Work 


Office 


Introducing  the  new  Microsoft  Office  System. 

Now  users  can  do  more  for  themselves  so  you  can  focus 
on  the  important  things.  More  than  just  the  core  suite 
you're  familiar  with,  the  new  Microsoft®  Office  System  is 
an  integrated  system  of  easy-to-use,  expanded  programs, 
servers,  services,  and  solutions  that  help  end  users  be 
more  self-sufficient.  With  Microsoft  Office  Professional 
Edition  2003,  Microsoft  Windows®  SharePoint™  Services, 
and  Microsoft  Office  SharePoint  Portal  Server  2003,  end 
users  will  have  the  ability  to  create  and  manage  their 
own  team  work  spaces.  So  not  only  will  they  be  able 
to  collaborate  and  share  information  easily  and  more 
securely,  but  you'll  be  free  to  do  what  you  really  need  to 
do.  To  find  out  how  the  Microsoft  Office  System  can 
work  for  you,  go  to  microsoft.com/officelT 


Microsoft 
Office  System 

More  than  what  it  used  to  be,  it's  now  a 
comprehensive,  customizable  system. 

Programs 

Servers 

Services 

Access  2003 

Excel  2003 
Frontpage®  2003 
InfoPath™  2003 

OneNote™  2003 

Outlook®  2003 

PowerPoint®  2003 
Project  2003 
Publisher  2003 

Visio®  2003 

Word  2003 

Project  Server  2003 

Live  Communications 
Server  2003 

Exchange 

Server  2003 

SharePoint™  Portal 
Server  2003 

Live  Meeting 

Office  Online 

Solutions 

Solution  Accelerators 

Enabling  Technologies: 

Windows  Server™  2003,  Windows®  SharePoint  Services, 
Rights  Management  Services 
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No  one  asks  for  help  with 
a  sales  team  web  site. 
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THIS  IS  AN 
AD  TO  ANNOUNCE 
POWERFUL  YET 
SIMPLER  BACKUP, 
RECOVERY  AND 
E-MAIL  ARCHIVING 
SOLUTIONS. 


Computer  Associates® 
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CONNECTED' 


II  LEGATO 


SO,  WHOSE  AD  IS  IT? 


J-Jint:  We ’re  the  one  with  nearly  ten  years  of  experience 
protecting  and  restoring  data  on  millions  of  PCs. 

Anoth  er?  Our  exclusive  data  reduction  technology  is 
US  patent  #5,765,173.  More  than  mere  compression,  it 
can  reduce  storage  requirements  hy  over  50%,  and  makes 
our  solutions  way  more  scalable. 

OK,  enough  hints.  Time  for  the  answer: 

Connected. 

Surprised? 

1  hen  just  wait  until  you  see  what  this  new  technology 
can  do  for  automatic  data  capture,  archiving  and  recovery. 


And  how  simply  (and  economically)  it  can  do  it. 

With  the  only  tamper-proof  e-mail  archiving.  I  he 
easiest  to  manage  Windows  server  and  PC  data  protection. 
And  intelligent  default  settings  that  automate  the  most 
complex  of  activities.  All  of  which  make  backup,  recovery 
and  archiving  of  distributed  data  suddenly  a  painless  process. 

In  these  days  of  powerful,  highly  complicated  I  I  solutions, 
it’s  good  to  know  there’s  a  company  now  offering  powerful, 
highly  uncomplicated  ones. 

And,  it’s  good  to  now  know 
exactly  who  that  is. 


Connected  Corporation — www. connected. com/ recovery — 1-800-675-5972  (toll-free  North  America)  ©Connected  Corporation.  All  rights  reserved.  Connected  is  a  registered  trademark  of  Connected  Corporation. 
COMPUTER  ASSOCIATES  and  the  CA  logo  are  registered  trademarks  of  Computer  Associates  International,  Inc.  (CA).  LEGATO  and  the  LEGATO  logo  are  registered  trademarks  of  LEGATO  Systems.  Inc. 
VERITAS  and  the  VERITAS  logo  are  registered  trademarks  of  VERITAS  Software  Corporation.  Windows  is  a  registered  trademark  of  Microsoft  Corporation. 
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Cover  Story 

SECURITY  I  48 

Hand  Over 
Security 

Physical  and  information  security  have  been  con¬ 
verging,  often  under  the  control  of  IT.  But  compa¬ 
nies  are  increasingly  moving  the  role  of  policing 
security  out  of  IT  and  into  the  hands  of  an  inde¬ 
pendent  CSO.  Here’s  why  you  should  consider 
doing  the  same.  By  Christopher  Koch 

COVER  PHOTO  BY  STEPHEN  WEBSTER 


Capital  IQ  CTO  William  Murphy  (right)  felt  ethically  compromised— not  to 
mention  overworked— by  hanging  on  to  security.  So  he  requested  that 
new  CSO  Ken  Pfeil  (left)  report  to  a  managing  principal,  not  him. 


Features 

PROJECT  MANAGEMENT  I  AT&T  WIRELESS 
AT&T  Wireless  Self-Destructs  I  56 

The  story  of  a  botched  CRM  upgrade  that  cost  the  telco 
thousands  of  new  customers  and  an  estimated  $100  million 
in  lost  revenue.  Hard  lessons  learned.  By  Christopher  Koch 


A  VC  council  is  "a 
forum  where  there's 
no  pressure,  and  you 
really  get  a  chance  to 
have  real  communica¬ 
tion  between  your 
peers,”  says  E-Trade 
CTO  Josh  Levine 


MANAGEMENT  STRATEGIES  I  BP 
In  Sync  with  His  CEO  I  66 

For  five  years,  BP  CIO  John  Leggate  has  managed  people  and 
IT  systems  in  concert  with  his  CEO’s  acquisition-hungry  strategy. 
His  mantra:  Integrate  always,  outsource  often,  and  make  technol¬ 
ogy  pay — or  don’t  make  it  at  all.  By  Susannah  Patton 

CIO  PARTNERSHIPS 

Something  Ventured,  Something  Gained  I  74 

CIOs  and  venture  capitalists  are  back  together.  VCs  are  eager 
for  CIOs’  insights  on  startups.  CIOs  get  access  to  and  influence 
over  the  latest  technology.  By  Kim  Girard 

BOOK  EXCERPT  I  THE  FUTURE  OF 
COMPETITION 

How  to  Put  Your  Customers  to  Work  I  82 

It’s  getting  harder  for  companies  to  sustain  growth  and  create 
value  on  their  own.  It’s  time  to  loop  customers  into  the  act. 

By  C.K.  Prahalad  and  Venkat  Ramaswamy 
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The  right  software  can  help  today's  CIO 
become  tomorrow's  corporate  leader. 

It's  amazing  what  the  right  software  can  do  in  the  right  hands.  Just  ask  the 
CIOs  taking  advantage  of  our  management  software  for  utility  computing. 
They've  transformed  previously  complex  disparate  infrastructures  into 
integrated  springboards  for  business  success.  And  they've  capitalized  on 
tomorrow's  trends  while  heading  off  today's  problems,  all  while  maximizing 
their  existing  resources.  To  learn  how  management  software  can  benefit 
your  business,  not  to  mention  your  career,  go  to  ca.com/management3. 


Computer  Associates® 


©  2003  Computer  Associates  International,  Inc.  (CA).  All  rights  reserved. 
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Columns 

THE  EXCHANGE 
The  Top  10  Drivers 
for  Innovation  I  36 

Council  members  offer  up  their  own 
ways  of  fostering  an  innovative 
culture.  By  Martha  Heller 

TOTAL  LEADERSHIP 

How  to  Build  a  Great  Team  I  40 

Four  leadership  qualities  for  getting 
things  done.  By  Charlie  Feld 


APPLY  FOR  THE  PRESTIGIOUS 

CIO  ENTERPRISE  VALUE  AWARDS  NOW! 


For  more  information,  see  Page  97  or  visit  www.cio.com/awatds/eva. 

DEADLINE  EXTENDED  TO  MAY  14 


MAKING  I.T.  WORK 
Mad  as  Hell  I  44 

Readers  sound  off  on  CIO  leadership, 
outsourcing  and  the  IT  community’s 
fading  commitment  to  quality. 

By  Michael  Schrage 

REALITY  BYTES 

All  Work  and  No  Play  I  92 

Americans  have  stopped  taking  vacations. 
And  that’s  bad  for  business.  Not  the  travel 
business;  their  own.  By  Megan  Santosus 

CAREER  COUNSEL 

Switching  Tracks  I  96 

Deciding  which  transformations  are 
for  you  and  which  are  against  you. 

By  Beverly  Lieberman  and  Mark  Polansky 


Sections 

TRENDLINES  I  22 

Data  mining  for  carbs;  Murder  plot  most 
thick;  Activists  use  Web  to  preserve 
famous  house;  Must-see  TV  ads;  A  CIO’s 
best  friend.  And  more 

BY  THE  NUMBERS  I  26 

Your  CEO  still  doesn’t  get  IT. 

WASHINGTON  WATCH  I  30 

In  North  Carolina,  technology  equals 
prosperity. 

ESSENTIAL  TECHNOLOGY  I  103 

Disposable  technologies  promise 
convenience  and  savings.. .but  at  a  price. 

By  John  Edwards 


“IT  workers  are  becoming  more  ambivalent 
about  investing  themselves  in  their  implemen¬ 
tations.  After  all,  quality  implementations  make 
outsourcing  easier  to  accomplish.” 

-Michael  Schrage,  CIO  columnist,  on  IT  workers’  fears  Page  44 


UNDER  DEVELOPMENT  I  107 

One  R&D  company  hopes  to  expand 
nanotechnology’s  usefulness  by  integrating 
it  into  manufacturing  processes. 

PUNDIT  I  108 

Firewalls  alone  are  no  longer  enough 
to  protect  your  online  assets. 

In  Every  Issue 

FROM  THE  EDITOR 

Award  Rewards  I  14 

Why  winning  an  IT  award  is  one  of  the 
most  effective  tools  in  a  CIO’s  repertoire 
for  running  IT  like  a  business. 

By  Richard  Pastore 

INDEX  I  110 

EXECUTIVE  SUMMARY  !  112 

Abstracts  of  all  the  feature  stories  found 
in  this  issue. 
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YOU  WERE  THERE  FDR  THE  BDDM. 

You’ve  made  it  thrdugh  the  bust. 

Ndw  IT’S  time  td  hire. 

Someone  who  knows  IT  inside  and  out. 


SO  WHY  ARE  YOUR  PALMS  SWEATING? 


Your  IT  budget  has  been  approved.  It's  time  to  hire  -  but  where  do  you  turn  to  find  the 
right  fit?  At  Robert  Half  Technology,  we  really  understand  IT.  Our  unsurpassed  knowledge 
of  the  technology  marketplace  allows  us  access  to  the  very  best  and  brightest  in  the 
industry.  And  well  meet  your  requirements  quickly  and  cost-effectively.  So  whether 
you're  looking  for  someone  to  help  manage  your  Q  &  A  in  application  rollouts,  upgrade  your 
operating  system,  or  even  secure  systems  that  prevent  viruses  -  relax.  Talk  to  us  today. 
You’ll  get  the  right  person  for  the  job.  Guaranteed* 


ROBERT  HALF 

TECHNOLOGY 


Information  Technology  Professionals 


WE  GET  IT.  WE  SPEAK  IT.  WE  KNOW  IT. 

800.793.5533  .  roberthalftechnology.com 


A  Hobert  Half  International  Company 


details  on  our  guarantee,  contact  us  today!  ©Robert  Half  technology,  EOE 


If  you  still  think  of  Pitney  Bowes  as  the  postage-meter  people,  here's  a  thought: 
Today,  we’re  working  with  nearly  every  FORTUNE  500  company,  engineering  solutions 
that  go  far  beyond  the  mailroom. 

By  optimizing  the  flow  of  documents,  mail  and  data  that  stream  into  and  out  of 
your  organization,  we  can  transform  it  into  a  powerful  tool  for  advancing  business. 

The  results  can  be  extraordinary:  From  more-profitable  customer  relationships  to 
improved  cash  flow;  a  safer,  more-secure  operation  to  24/7  backup  in  case  of  disaster. 
The  list  is  virtually  endless.  But,  then,  so  are  our  ideas. 

Hopefully,  we've  piqued  your  curiosity.  But  we  can  assure  you  that  it  will  be  fully 
rewarded  with  a  visit  to  pb.com/solutions.  Or,  if  you  prefer,  a  call  to  1  866  DOC  FLOW. 

Pitney  Bowes 


Engineering  the  flow  of  communication m 


INTERACTIVE 

>features 

Interactive  features  from  April  15  to  April  30 


ASK  THE  SOURCE 

What’s  the  Key  to  a 
Good  CIO-VC  Relationship? 

E-Trade  CTO  Josh  Levine  can  offer  some  insights. 

He  sits  on  a  few  venture  capitalists’  IT  advisory 
groups.  What  are  the  benefits?  What  are  the 
requirements?  Read  Something  Ventured,  Some¬ 
thing  Gained  (Page  74),  and  for  any  unanswered 
questions,  ASK  THE  SOURCE.  Submit  your  ques¬ 
tions  online  through  April  30.  Go  to 
www.cio.com/experts. 

LEARN  MORE 

About  the  Bumpy  Road  of  M&A  Integration 

BP  has  sometimes  had  a  bumpy 
road  in  its  bold  pursuit  of  integra¬ 
tion  and  outsourcing  (In  Sync  with 
His  CEO,  Page  66),  but  the  com¬ 
pany  was  one  of  100  recognized 
for  excellence  in  integration  for  the 
CIO  100  Awards  in  2002.  Mergers 
and  Acquisitions  profiles  BP  and 
five  others  doing  post  M&A 
integration.  To  read  the  story,  go 
to  www.cio.com/printlinks. 


ADD  A  COMMENT 

How  Connected 
Are  Your  Customers? 
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In  the  excerpt  from  their  book 
The  Future  of  Competition, 

C.K.  Prahalad  and  Venkat 
Ramaswamy  suggest  that  j 
IT’s  future  vaiue  will  come 
from  giving  customers  a  better 
experience  with  the  organization  (How  to  Put 
Your  Customers  to  Work,  Page  82).  Do  you 
agree?  Scroll  to  the  bottom  of  the  online  version 
of  this  story  and  ADD  A  COMMENT. 


tryt$Si 


ARE  YOU  GOING  to  hand  over  or  hang  on  to 
responsibility  for  security?  Read  Hand  Over 
Security  on  Page  48  to  decide.  You  need 
to  know  if  your  practices  are  repeatable, 
documented,  and  regularly  reviewed  and  up¬ 
dated.  CIO’s  sister  publication,  CSO,  and  the 


Software  Engineering  Institute’s  CERT 
Coordination  Center  created  the  Security 
Capability  Assessment  Tool  to  let  security 
professionals  assess  their  current  practices. 
To  take  the  test,  go  to  www.cio.com/printlinks 
for  the  link. 
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Thankfully  that  cost  is  low  with  the  new  Firebox*  X  -  the 
integrated,  expandable  network  security  appliance  that  delivers 
the  highest  security  at  the  lowest  total  cost  of  ownership. 


WatchGuard 


Firebox^ 


UUc 

The  Security  You  Really  Need.™  WatchGliard^^F 


©Copyright  2004.  WatchGuard  Technologies,  Inc.  All  rights  reserved.  WatchGuard,  The  Security  You  Really  Need  and  Firebox  are  either 
registered  trademarks  or  trademarks  of  WatchGuard  Technologies,  Inc.  and/or  its  subsidiaries  in  the  United  States  and/or  other  countries. 


FREE  NETWORK  11  Reality  Checks  to  Get  yours  by  visiting  www.watchguard.com/ciocya 

SECURITY  GUIDE  Help  the  CEO  ‘CYA’  or  by  calling  1-877-732-8780. 


From  the  Editor 


To  read  more  about  the 
award  winners  that  CIO 
Editor  Richard  Pastore 
recently  celebrated  with, 
read  our  Feb.  1, 2004,  issue 
covering  the  CIO  Enterprise 
Value  Award  winners.  Get  to 
it  at  www.cio.com/printlinks. 


Award  Rewards 


I’M  SITTING  AT  A  BANQUET  TABLE  elegantly 
set  for  10,  the  other  seats  graced  by  tuxedo-  and 
gown-clad  executives  and  superintendents  from 
Procter  &  Gamble  and  the  Chicago  Police  Depart¬ 
ment  respectively.  There’s  electricity  in  the  air,  sus¬ 
pense,  camaraderie.  CIO  magazine  is  honoring  my 
tablemates  with  an  award  for  achieving  outstanding 
value  through  information  technology.  When  CIO 
Editor  in  Chief  Abbie  Lundberg  announced  the  win¬ 
ners,  each  group  rose  en  masse  to  collect  their 
award,  buoyed  by  cheers  (and  whistles!)  from  the 
200  or  so  people  filling  the  hall. 

Reading  their  faces,  I  see  both  pride  and  humility, 
and  in  one  case,  a  little  tear  in  the  eye.  After  return¬ 
ing  to  the  table,  individuals  from  both  P&G  and  the 
police  lean  over  to  me  and  say,  in  different  words  but 
to  the  same  effect:  “You  can’t  imagine  how  impor¬ 
tant  this  is  to  us,  how  it  affects  our  organization.” 

Yes  I  can. 

I  know  winning  an  award  is  more  than  a  brief 
moment  in  the  spotlight,  a  temporary  morale  booster 
for  overworked  IT  employees  back  home.  I  have 
proof  that  IT  awards  are  in  fact  one  of  the  most 
effective  tools  in  a  CIO’s  repertoire  for  running  the 
IT  organization  like  a  business. 

Yes.  Like  a  business. 

We  recently  asked  CIOs  at  more  than  100  com¬ 
panies  with  respected  IT  reputations  to  tell  us  how 
they  run  IT  like  a  business.  (You’ll  get  the  full 
results  and  analysis  in  our  next  issue.)  Staring  at 
me  off  an  Excel  printout,  near  the  top  of  the  list  of 
the  most  effective  practices,  was  this:  “Winning 
and  showcasing  IT  awards.” 

Huh? 

Winning  awards  was  ahead  of  strategic  planning 
meetings?  It  outranked  auditing?  It  eclipsed  risk 
management,  chargeback  and  internal  customer 


satisfaction  surveys?  I  dared  to  ask  our  research 
guru  Lorraine  Cosgrove  Ware  to  recheck  the  num¬ 
bers.  She  humored  me  and  recalculated  the  find¬ 
ings.  The  results  were  the  same. 

So  I  pondered.  Winning  awards  increases  morale, 
which  increases  energy  levels,  which  increases  pro¬ 
ductivity.  A  highly  productive  team  is  critical  for  a 
healthy  business. 

Winning  respected  awards  from  objective  third 
parties  increases  credibility  in  the  enterprise.  IT 
needs  credibility  to  be  perceived  as  more  than  a 
cost  center — to  be  considered  a  disciplined,  effective 
business  function.  One  that  would  be  missed  if  it 
were  outsourced  to  India  or  China. 

Sharing  credit  for  IT  awards  with  the  business 
sponsors  increases  mutual  respect  and  reinforces 
the  value  of  strong  IT-business  partnerships.  The 
ability  to  partner  successfully  is  a  hallmark  of  any 
healthy  business. 

As  soon  as  this  lightbulb  went  on  in  my  head,  I 
got  another  flash — we’ve  got  to  create  more  IT- 
business  awards  programs!  We’ve  got  to  help  CIOs 
succeed  at  running  their  organizations  like  well- 
oiled  businesses. 

If  you  have  any  ideas  for  new  awards  programs, 
send  them  my  way.  In  the  meantime,  visit 
www.cio.com/ 'awards  and  check  out  our  existing 
programs.  I  want  to  sit  next  to  you  at  the  next 
awards  banquet  and  bask  in  your  business  glory. 


Richard  Pastore,  Editor 
pastore@cio.com 
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All  those  who  need  to  understand  how  to 
integrate  IT  controls  with  the  Sarbanes-Oxley  • 

internal  control  reporting  requirements...  Say  I’ 


The  Facts 


IT  controls  are  often  at  the  center  of  the  internal  control 
environment.  Forward-thinking  companies  are  actively 
addressing  the  impact  of  Information  Technology  risks 
and  controls  as  an  integrated  component  of  their 
response  to  the  Sarbanes-Oxley  internal  control 
requirements.  Appropriate  consideration  of  technology 
controls  can  significantly  enhance  management’s  ability 
to  rely  on  other  controls  and  could  enable  reductions  in 
other  process  documentation  and  testing.  Have  you 
evaluated  how  the  IT  controls  impact  your  financial 
reporting?  What  is  your  strategy  for  integrating  IT  risks 
and  controls  with  your  evaluation  of  internal  control 
over  financial  reporting?  Can  you  validate  the  operating 
effectiveness  of  key  IT  controls?  Do  you  have  the 
insight  of  an  independent  advisor? 

Protiviti  has  developed  a  guide  to  specifically  address 
the  tough  IT  questions  that  arise  when  considering 
the  role  and  impact  of  IT  controls  on  Sarbanes-Oxley 
compliance. 


Contact  Protiviti,  the  leader  in  independent  risk 
consulting  and  internal  audit  services.  We  provide 
international  services  for  established  and  emerging 
companies  to  independently  help  them  identify,  measure 
and  manage  risk.  Our  professionals  have  experience  in 
a  wide  range  of  industries.  So  whether  your  challenge  is 
reporting  accurate  results,  maximizing  the  value  of 
technology  or  adopting  business  controls  you  can  trust, 
Protiviti  delivers  quantifiable  solutions  that  make  a 
difference...Are  you  ready  to  Say  i? 


Get  the  facts.  To  get  your  free  copy  of  Protiviti’s  Guide  to 
the  Sarbanes-Oxley  Act:  IT  Risks  and  Controls  or  the  updated 
Sarbanes-Oxley  Section  404  Guide ,  call  888.556.7420 
or  visit  www.protiviti.com. 


©  2004  Protiviti  Inc.  EOE 


Business  Risk 


Technology  Risk 


Internal  Audit 
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CAN  LINUX  DELIVER  LOWER  TCO? 
ASK  THE  PEOPLE  EVALUATING  IT. 


Microsoft 


"We  conducted  a  major  TCO  study  to 
explore  Microsoft  and  Linux  solutions 
for  our  needs.  In  the  end,  we  found  that 
the  TCO  for  the  Windows  Server  System ™ 
approach  was  about  20  percent  less 
expensive  than  Linux." 

— Keith  Morrow,  CIO,  7-Eleven,  Inc.,  U.S. 


7-Eleven  chose  Microsoft  over  Linux  because  of  the  20  percent  savings  in  total  cost  of  ownership 
for  their  5,800  U.S.  and  Canadian  stores'  highly  complex  POS  system.  In  their  evaluation,  7-Eleven 
was  looking  for  an  option  that  could  meet  serious  technical  requirements  with  a  low  TCO.  Their 
study  found  that  only  the  Microsoft®  platform  could  meet  their  criteria.  To  get  the  full  7-Eleven 
case  study  and  more  third-  party  findings,  visit  microsoft.com/getthefacts 


0  2004  Microsoft  Corporation.  All  rights  reserved.  Microsoft,  the  Windows  logo,  and  Windows  Server  System  are  either  registered  trademarks  or  trademarks  of 
Microsoft  Corporation  in  the  United  States  and/or  other  countries.  7-ELEVEN®,  the  7-ELEVEN  Design  and  OH  THANK  HEAVEN*’  are  registered  trademarks  of  7-Eleven,  Inc. 
The  names  of  actual  companies  and  products  mentioned  herein  may  be  the  trademarks  of  their  respective  owners. 


Microsoft 


Windows 
Server  System 


The  Resource  for  Information  Executives 


- 


President  and  CEO  Walter  Mannlnen 
Publisher  Gary  J.  Beach 

Editorial  Director  Lew  McCreary 

EDITORIAL 

Editor  in  Chief  Abbie  Lundberg 
Editor  Richard  Pastore 
Managing  Editor  David  Rosenbaum 
Managing  Editor,  Production  Cheryl  R.  Asselin 

Executive  Editors  Alison  Bass,  Michael  Goldberg, 
Christopher  Koch 

Leadership  and  Management  Editor  Edward  Prewitt, 
Opinion  and  Knowledge  Management  Editor  Megan 
Santosus,  Research  Editor  Lorraine  Cosgrove  Ware, 
Special  Projects  Editor  Mindy  Blodgett,  Technology 
Editor  Christopher  Lindquist 

Senior  Editors  Scott  Berinato,  Todd  Datz, 

Alice  Dragoon,  Elana  Varon 

Senior  Writers  Meridith  Levinson,  Stephanie  Overby, 
Ben  Worthen 

Staff  Writer  Tom  Wailgum 
Asst.  Managing  Editor,  Production  Kathleen  S.  Carr 
Senior  Copy  Editor  Emily  S.  Henderson 
Copy  Editors  Sarah  Johnson,  Cathy  Mallen 
Assoc.  Copy  Editor  Daniel  John  Robinson 
Special  Projects  Manager  Lynne  Z.  Rigolini 
Editorial  Resource  Manager  Carol  Zarrow 
Editorial  Assistants  Daniel  J.  Horgan,  Albert  Sacco 
Editorial  Operations  Specialist  Julie  Hanson 

Contributors  Ted  Smalley  Bowen,  John  Edwards, 
Charlie  Feld,  Kim  Girard,  Grant  Gross,  Eric  Knorr, 
Beverly  Lieberman,  Susannah  Patton,  Michael  Schrage 

Research  Contributor  Sally  Chicotel 


How  to  Reach  Us 

E-mail  letters@cio.com 
Phone  508  872-0080 
Fax  508  879-7784 

Address  CIO  Magazine,  CXO  Media  Inc., 

492  Old  Connecticut  Path,  P.0.  Box  9208, 

Framingham,  MA  01701-9208 

Website  www.cio.com 

Topic  Experts  www.cio.com/oniine_beats2.htmi 

Subscriber  Services  866  354-1125,  Fax  847  564-9453, 
E-mail  cio@omeda.com 

Reprint  Services  Jackie  Day  •  651  582-3856, 

E-mail  cioreprints@rsicopynght.com  (500  quantity  or  more) 

Rights  and  Permission  Andrew  Burrell  •  508  935-4785, 
E-mail  aburrell@cio.com 


DESIGN 

Executive  Director,  Art  and  Design  Mary  Lester 
Art  Director  Terri  Haas 

Associate  Art  Directors  Owen  Edwards,  George  Lee, 
Scott  Shultz 

Senior  Designer  Kaajal  S.  Asher 

Design  Operations  Specialist  Rachel  Barnett 

Design  Contributors  Alberto  Capolino,  Leslie  Feagley, 
Andrea  Healy 

ONLINE  EDITORIAL 

Web  Editorial  Director  Art  Jahnke 
Consulting  Editor  Janice  Brand 
Web  Editor  Sandy  Kendall 
Web  Writer  Jon  Surmacz 

ONLINE  &  INFORMATION  SYSTEMS 

Chief  Information  Officer  Mark  Hall 

Online 

Senior  VP/General  Manager,  Online  Tim  Horgan 
Online  Technology  Director  Dagmar  Eiben 
Senior  Web  Developers  Diane  Chen,  Ellen  Morey 
Director  of  Online  Research  Kathleen  Kotwica 
E-Commerce  Manager  Andrew  Burrell 
Online  Producer  Shannon  Macdonald 
Online  Content  Researcher  Tara  Gillet-Liloia 
Designer  Graham  White 

Information  Systems 

Infrastructure  Manager  James  C.  Burgoyne 

User  Services  Manager  Ron  Bettencourt 

Senior  User  Services  Specialists  Jonathan  Frappier, 
Michael  Fahlsing 

System  Administrator  Robert  Reagan 

CIRCULATION 

Senior  VP/Circulation  Carol  A.  Spach 
Circulation  Director  Faith  Marcello 
Subscription  Svcs.  Supervisor  Tina  Pescaro 

PRODUCTION 

VP/Manufacturing  Chris  Cuoco 
Production  Manager  Lee  Tuttle 
Senior  Production  Coordinator  Lisa  Stevenson 

EXECUTIVE  PROGRAMS 

EP  Senior  Vice  President  Jennifer  Richards 
Conference  Management  Vice  President  Cynthia  Mollus 
Marketing  Services  Director  Shellie  Rapson  James 
Business  Development  Vice  President  John  Amato 
Business  Development  Director  John  Vulopas 
Content  Development  Manager  Lafe  Low 
Program  Operations  Manager  Brian  Fuce 
Marketing  Manager  Glede  Kabongo 


Marketing  Design  Specialist  Andrea  Slobogan 
Senior  Client  Relations  Specialist  Sandra  J.  Hughey 
Senior  Logistics  Coordinator  Michael  Barbato 
Event  Planning  Director  Amy  Turell 
Senior  Customer  Services  Coordinator  Sarah  Yee 

CIO  EXECUTIVE  COUNCIL 

General  Manager  Mark  Hall 

Director  Martha  Heller 

Director  of  External  Relations  Karen  Fogerty 

Consulting  Editor  Richard  Pastore 

Contributing  Editor  Janice  Brand 

Program  Managers  Bill  Golden,  Mindy  Hogan, 

David  Parker,  Steve  Rovniak,  Stacy  Sudan, 

Greg  Szumowski 

Operations  Assistant  Lisa  Byron 

MARKETING 

Executive  VP/Marketing  Cathy  O'Leary  Hayes 

VP/News  and  Information  Susan  Watson 
Program  Administrator  Lori  Piscatelli 
Marketing  Research  Director  Bridget  Cammarata 

Marketing  Research  Managers  Carolyn  Johnson, 
Dylan  DiGregorio 

Marketing  Comm.  Director  Sue  Yanovitch 
Sr.  Marketing  Comm.  Specialist  Sarah  Crowley 

ADMINISTRATION 

Director  of  Finance  Margarita  Chiango 
Finance  and  Operations  Analyst  Chris  Bernardi 
Executive  Assistant  to  the  President  Diane  Martin 
Billing  Administrator  Joyce  Gillis 
Facilities  Specialist  John  Kelley 
Office  Services  Coordinator  Mary  E.  Wooldridge 

HUMAN  RESOURCES 

Human  Resources  Vice  President  Patricia  Chisholm 
Human  Resources  Manager  Tanya  Bureau 
Senior  HR  Representative  Beth  S.  Ramistella 

FOUNDER 

Joseph  L.  Levy 


INTERNATIONAL  DATA  GROUP 

CEO  Pat  Kenealy 

Board  Chairman  Patrick  J.  McGovern 

wbpa 

▼  INTERNATIONAL  • 

©CXO  Media  Inc. 


i 


4 


18  CIO  APRIL  15,  2004 


www.cio.com 


INTRODUCING  QWEST  iQ  NETWORKING/ 

PLUG  YOUR  COMPANY  IN.  WE’LL  MAKE  IT  PLAY. 


A  network  is  a  network  is  a  network.  That  is,  until  you  want  to  add  a  new  application  like  Voice  Over  IP. 
Or  integrate  x.25  legacy  nodes  into  a  network  built  for  frame  relay  or  ATM.  Or  get  something  done  through  an 
accountable  single  point  of  contact.  The  fact  is,  you  can  never  be  sure  what  you're  going  to  do  next  with  your 
network,  or  what  device  you'll  be  hanging  off  of  it.  And  you  don’t  want  to  be  with  a  vendor  who’s  going  to  tell 
you  to  throw  out  your  infrastructure  and  start  over.  Which  is  why  you  want  to  be  with  Qwest.® 


Call  1  800-506-0663  or  visit  qwest.com/networksoiutions 


i  s 


[Qwest 

Spirit  of  Service 


VOICE  0  L  U  T  I  0  N  S  DATA  SOLUTIONS  INTERNET  SOLUTIONS  MANAGED  SOLUTIONS 


Qwest  iQ  Networking  is  a  suite  of  WAN  services  with:  domestic  and  international  availability  depending  on  services  selected  Recurring  fees  vary  depending  on  services  ordered 
Additional  equipment  may  be  required.,  Qwest  and  Qwest  iQ  Networking  are  trademarks  Of  Qwest  Communications  International  Inc  ©2004  Qwest  All  rights  reserved 


SETTING  NEW  NETWORK 
SECURlTV  PRIVILEGES 
FOR  860  USERS?  THAT'LL 
TAKE  DAVS...  WEEKS... 


These  days,  no  network  is  free  of  threats.  That’s  why  yon  have  to  assign  network  security  privileges  to 
everyone.  Employees,  customers,  and  partners.  You  need  to  set  an  acceptable  use  policy  that  dictates 
what  each  of  them  can  and  can’t  access.  Until  now,  you  had  to  do  this  manually. 

Not  anymore.  Now  you  can  do  what  Baylor  University  did.  Implement  an  Enterasys  Secure  Networks™  solution 
with  a  unique,  policy-based  system  that  empowers  the  network  to  allocate  resources  based  on  specific  users 
and  their  roles.  The  network  “sees”  who  the  user  is  and  assigns  privileges  accordingly.  This  unproved  control 
also  gives  you  more  security. 

It’s  all  about  giving  you  a  smarter  way  to  network  with  central,  intuitive  management.  Find  out  more  at 
networksthatknow.com/Baylor.  Or  ask  any  one  of  the  many  enterprise  customers  we’ve  worked  with  for  years. 


Federico  da  Montefeltro  (above)  wrote 
an  encrypted  letter  pledging  support 
for  a  1478  plot  to  murder  members  of 
the  Medici  family. 
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INVESTIGATIONS 

Murder  Plot  Most  Thick 

TALK  ABOUT  STRONG  ENCRYPTION.  It  took  five 
centuries  to  untangle  the  code  in  a  letter  written 
by  a  previously  unknown  collaborator  in  a  famous 
Italian  Renaissance  murder  plot. 

The  Pazzi  conspiracy,  named  for  a  wealthy 
Florentine  banking  family,  was  audacious.  Its  targets: 
Lorenzo  de'  Medici  and  his  brother  Giuliano,  who 
were  ruling  elites  in  Florence.  The  place:  The  city’s 
cathedral,  during  high  Mass  on  April  26, 1478.  The 
goal:  End  the  Medici  rule  over  Florence  while  giving 
Pope  Sixtus  IV  more  power  in  the  region. 


The  plot  failed— Lorenzo  survived  his  stab  wound, 
though  Giuliano  died,  the  Columbia  Encyclopedia 
tells  us.  The  Medici's  reign  continued.  Florentines 
hunted  down  the  conspirators  to  exact  revenge. 

Except  that  they  missed  one.  Now,  526  years  after 
the  deed,  Marcello  Simonetta,  a  Wesleyan  University 
Romance  language  professor,  has  uncovered  and  then 
deciphered  an  encrypted  letter  written  by  one 
Federico  da  Montefeltro,  the  Duke  of  Urbino,  a 
prominent  politician  and  famous  art  collector.  The 
duke,  it  turns  out,  was  a  key  coconspirator  who  offered 
troops  to  Sixtus  IV  to  help  kill  the  Medicis.  He  sent  the 
letter  two  months  before  the  murder. 

The  duke  “was  known  as  one  of  the  most  refined 
men  of  the  Renaissance,”  Simonetta  told  The  New  York 
Times.  That  was  before  the  professor  cracked  the  code. 


Restaurant  chain  finds  demand  for 
Atkins  dishes  in  point-of-sale  data 


falo  wings,  sizzling  New  York 
strip  steak  with  blue  cheese 
and  six  other  main  courses 
without  guilt,  knowing 
they’ve  been  jointly  designed 
by  T.G.I.  Friday’s  and  Atkins 
Nutritionals’  chefs  with  a 
view  to  reducing  carbs. 

What’s  interesting  about 
this  carb-reducing  campaign  is 
that  it’s  more  than  an  effort  to 
latch  onto  a  hot  diet  trend. 
T.G.I.  Friday’s  was  able  to 
uncover  the  low-carb  demand 
among  its  patrons’  special-order 
requests  last  summer.  Negotia¬ 
tions  with  Atkins  were  done  by 
November,  and  the  new  entrees 
appeared  in  December  2003. 


Deborah  Lipscomb, 

CIO  of  Carlson  Restaurants 
Worldwide,  T.G.I.  Friday’s  par¬ 
ent  company,  says  that  business 
analysts  studied  the  special 
instructions  that  patrons  had 
given  waiters.  They  noticed  that 
a  lot  of  guests  were  asking 
servers  to  hold  the  fries  or  to 


replace  mashed  and  baked 
potatoes  with  salads  and  veg¬ 
etables.  “The  data  told  us  that 
people  were  trying  to  eat  low- 
carb,”  says  Lipscomb.  “When 
we  noticed  the  trend,  we 
thought  it  would  be  a  good 

Continued  on  Page  24 


T.G.I.  FRIDAY’S  used  to  be  a 
casual  dining  chain  known  for 
its  big  burgers,  mixed  drinks 
and  suspender-wearing  waiters 
sporting  buttons  that  promised 
sweet  desserts.  But  if  you’ve 
dined  there  lately,  you  may  have 
noticed  the  variety  of  entrees 
and  appetizers  on  the  menu  that 
are  labeled  “Atkins  approved.” 

The  logo  indicates  that  if 
you’re  following  the  popular 
and  controversial  low-carbohy¬ 
drate,  high-protein  Atkins  diet, 
you  can  safely  scarf  T.G.I.  Fri¬ 
day’s  Tuscan  spinach  dip,  buf- 


Data  Mining  for  Carbs 


I 


OSSVOId  NVU  AH  NUIlVdlbl  I  I  II  AOi  I  ivy 


THE  POWERTO  Create,  Confirm,  Control 

Software  and  services  from  Compuware  help  create  applications  that  move  into  action  faster. 
Solutions  for  development,  quality  assurance  and  operations  let  you  confirm  efficient 
deployment  and  ongoing  availability  with  confidence.  Achieve  control  over 
application  performance  and  exceed  the 
quality  your  end  users  demand — now. 
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GRASSROOTS  I.T. 

Activists  Use  Web  to 
Preserve  Famous  House 


Preservationists  used  e-mail  and  other  tools  to  save  van  der 
Rohe's  Farnsworth  House  (above)  from  an  uncertain  fate. 


FARNSWORTH  HOUSE  is  a  modern  master¬ 
piece  of  home  design— a  steel,  concrete  and 
glass  single-story  house  in  Plano,  III.,  built  in 
1951.  It’s  one  of  Ludwig  Mies  van  der  Rohe’s 
best-known  works,  an  icon  of  the  Interna¬ 
tional  Style,  studied  at  architecture  schools 
the  world  over.  And  last  December  it  was 


scheduled  for  auction,  with  no  holds  barred 
on  what  could  happen  to  the  structure. 

That's  when,  advocates  say,  tools  of  the 
Internet  age— online  communications,  data 
mining  and  demographic  software— made  a 
real  difference  in  their  campaign  to  save 
Farnsworth  House  from  an  uncertain  future. 
Historic  preservation  groups  used  websites 
and  e-mail  appeals  to  friends  of  architecture 
far  and  wide.  That  and  media  coverage 
prompted  enough  phone  pledges  to  allow 
the  preservationists  to  close  the  bidding  at 
Sotheby's  at  $6.7  million.  The  National  Trust 
for  Historic  Preservation  plans  to  open  the 
Farnsworth  House  as  a  museum  this  spring. 

Political  organizing  and  fund-raising 
fixtures  such  as  direct  mail  and  phone  banks 
aren’t  going  away,  but  preservation  groups 
are  finding  that  new  tools  make  them  more 
effective.  Websites  and  e-mail  allow  preser¬ 
vation  groups  to  quickly  assemble  coalitions 
of  politicians,  developers  and  citizens  to 
draw  up  and  circulate  plans,  and  repeat  the 
process  if  needed,  says  Lisa  DiChiera, 


advocacy  director  for  the  Chicago-based 
Landmarks  Preservation  Council  of  Illinois 
( www.landmarks.org ). 

“Ten  years  ago,  it  was  mass  fax.  Now 
mass  e-mail  lets  us  more  quickly  and 
efficiently  get  information  to  our  members 
and  to  connect  with  other  organizations  that 
we  see  ourselves  allied  with,  like 
environmental  and  smart  growth 
groups,”  DiChiera  says.  “And  our 
website  is  critical  for  background 
and  updates.” 

The  Chicago  group  is  a  tiny  band 
of  eight  compared  with  the  Wash¬ 
ington,  D.C. -based  National  Trust. 

Its  300-member  staff  boasts  more 
sophisticated  fund-raising  and 
lobbying  operations.  The  Trust 
recently  generated  thousands  of 
e-mails  pressuring  the  Senate  to 
reject  a  rollback  of  heritage  protec¬ 
tion  requirements  in  federal  road 
projects  (which  it  did),  says  Dolores 
McDonagh,  vice  president  of 
membership  development. 

The  Trust  farms  out  the  hosting  of  its 
complex  membership  software,  but  in- 
house  it  maintains  a  million-record  data¬ 
base,  accounting  software,  a  network  linking 
regional  offices  and  historic  sites,  numerous 
websites  and  a  BlackBerry  server,  McDon¬ 
agh  says.  The  Trust  uses  Capwiz  demo¬ 
graphic  and  organizing  software  to  zero  in 
on  constituencies  and  tailor  appeals,  says 
assistant  Web  editor  Meghann  Sullivan. 

Online  donations  jumped  from  $29,000  in 
2002  to  $100,000  last  year  (out  of  $9  million 
total),  says  McDonagh.  Online  donors  tend  to 
be  younger  and  more  generous  than  the 
overall  membership,  she  adds. 

Daniel  Bluestone,  director  of  the  Univer¬ 
sity  of  Virginia’s  historic  preservation 
program,  says  that  while  e-mail  and 
websites  may  increase  communication, 
“preservation  is  about  developing  place 
attachments,  and  it’s  possible  that  the 
more  we’re  in  cyberspace  the  less  we're 
living  in  real  space.”  -Ted  Smalley  Bowen 


Data  Mining 

Continued  from  Page  22 

idea  to  explore  putting  low-carb  items 
on  our  menu.” 

Using  a  business  intelligence  tool  from 
Cognos,  the  IT  staff  at  Carlson  Restau¬ 
rants  captured  data  on  patrons’  orders 
that  waiters  and  waitresses  had  entered 
into  the  restaurants’  point-of-sale  systems 
and  put  it  into  data  sets  that  business 
analysts  could  dissect  quickly  and  easily. 

Since  Hollywood  hunks  such  as  Brad 
Pitt  and  screen  sirens  Sarah  Jessica 
Parker  and  Renee  Zellweger  attributed 
their  sculpted  abs  and  pared-down  pro¬ 
portions  to  high-protein  regimes,  mil¬ 
lions  of  Americans  began  pooh-poohing 
pasta,  potatoes  and  pain.  Even  the  exec¬ 
utive  team  at  T.G.I.  Friday’s  is  meticu¬ 
lously  monitoring  its  carbohydrate 
intake,  Lipscomb  says.  “Low-carb  just 
happens  to  be  a  trend  at  T.G.I.  Fri¬ 
day’s,”  she  says.  “Because  we  live  it,  we 
saw  the  relationship  between  how  we’re 
eating  and  what  our  customers  want  in 
the  [point-of-sale]  data.” 

The  business  analysts  who  made  the 
discovery  took  their  findings  to  the  exec¬ 
utive  team,  whose  members  knew  com¬ 
petitors  were  offering  low-carb  meals. 
Competitor  Ruby  Tuesday  rolled  out  its 
selection  of  30  low-carb  menu  options  on 
Nov.  11,  2003,  28  days  before  T.G.I.  Fri¬ 
day’s  followed  suit.  Others  following  the 
trend  include  P.F.  Chang’s  China  Bistro. 

Wanting  to  one-up  the  competition, 
Carlson  Restaurants  approached  Atkins 
Nutritionals,  the  company  founded  by 
the  late  Dr.  Robert  C.  Atkins  to  provide 
food  products  and  nutritional  supple¬ 
ments  in  support  of  the  eponymous  diet, 
about  jointly  developing  low-carb 
lunches  and  dinners,  and  licensing  the 
Atkins  brand.  “We  felt  the  best  way  to 
communicate  to  our  guests  that  we  are 
here  to  help  them  in  their  lifestyle 
choices  was  to  have  a  brand-name  part¬ 
nership,”  says  Lipscomb. 

While  Lipscomb  admits  to  being  a 
little  lax  in  her  personal  devotion  to  the 
diet,  she  proudly  notes  that  by  last  Feb¬ 
ruary,  her  executive  team  has  collectively 
lost  almost  90  pounds. 

-Meridith  Levinson 
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Compuware 

OptimalJ 


THE  POWER  TO  Develop,  Transform,  Reuse 

Put  your  J2EE™  application  development  into  overdrive — with  unmatched  quality  and 
unprecedented  flexibility — using  Compuware  OptimalJ.  Increase  developer  productivity  up 
to  9096.  Seamlessly  instill  quality  into  development.  Forge  existing  infrastructures  and  new 
technologies  into  an  integrated  whole. 

Realize  business  agility  with  applications 
that  are  truly  reusable,  time  and  time  again. 


The  leader  in  IT  value.  ^ 
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Your  CEO  Still  Doesn’t  Get  IT 


MORE  THAN  TWO-THIRDS  of  CIOs  say 
that  their  CEOs  view  IT  as  a  cost  of 
doing  business — and  not,  unfortunately, 
as  a  business  enabler.  That’s  according  to 
a  survey  of  more  than  700  CIOs  by  Meta 
Group.  Findings  from  C/O’ s  “State  of 
the  CIO  2003”  survey  showed  similar 
numbers:  A  whopping  84  percent  of  539 
respondents  said  IT  was  budgeted  as  a 
cost  center,  while  only  16  percent  said  IT 
was  budgeted  as  an  investment  center 


that  creates  new  business  capabilities. 

While  you  know  that  IT  has  strategic 
value,  chances  are  your  CEO  doesn’t, 
and  it’s  up  to  you  to  show  him.  Accord¬ 
ing  to  Jonathan  Poe,  senior  vice  presi¬ 
dent  at  Meta  Group,  CIOs  typically 
aren’t  proactive  in  communicating  and 
demonstrating  IT’s  value  to  business 
executives.  Those  who  are  believe  that 
solving  alignment  problems  will  put  IT 
on  the  CEO’s  radar. 


How  CIOs  Say  Their  CEOs  View  IT 


Transformation  center 

We  let  IT  do  high  failure  R&D. 


Strategic  center  - 

IT  returns  measured 
value  to  the  corporation. 


Value  center 

We  get  a  return 
on  our  budget. 


Cost  center 

IT  is  expensive. 


What  CIOs  Are  Doing  to  Change  That  Perception 


Improving  alignment  between  business  and  IT 


Value-management  efforts 

Creating,  capturing  and  communicating  IT  values 


Leadership 

Making  better  decisions  despite 
IT’s  increased  complexity 


SOURCE:  Meta  Group 


CIOs  focus 
on  improving 
alignment  almoa 
twice  as  much  as 
value  management. 


Best  Practices 

Strengthen  and  nurture  the  important 
relationships.  Street-smart  CIOs  manage 
executive  relationships  in  a  high-touch 
manner  (lots  of  face  time)  that  simultane¬ 
ously  increases  business  perception  and  CIO 
credibility.  “A  strategic  relationship  with  the 
CEO  requires  a  lot  of  reinforcement,”  says 
Meta  Group’s  Jonathan  Poe.  “Relationships 
taken  for  granted  are  typically  short-lived.” 

Mediate  via  portfolio  management. 

Portfolio  management  (the  practice  of 
administering  IT  projects  and  assets  as  an 
investment  portfolio  with  expected 
payback  returns)  can  help  overcome  the 
gulf  between  business  and  IT  executives. 
IT  portfolios  have  transparent  and  holistic 
views  of  the  organization,  which  help 
businesses  understand  more  fully  the 
collaboration  needed  to  balance  and 
satisfy  enterprise  and  line-of-business 
requirements. 

Make  value  an  everyday  execution. 

Most  CIOs  understand  that  they  need  to 
communicate  IT  value.  Before  commun¬ 
ication,  however,  they  must  create  and 
demonstrate  IT  value,  both  strategic  (such 
as  time-to-market)  and  tactical  (system 
availability). 

Mold  a  staff  to  reflect  your  values  and 
leadership  style.  “Too  many  CIOs  make  do 
with  an  inherited  staff  that  was  built  for 
someone  else  [who  has  left],"  says  Poe. 
Skilled  CIOs  assemble  staff  and  deputies 
who  both  enhance  their  strengths  and 
overcome  their  shortcomings.  By  possess¬ 
ing  a  staff  that  shares  a  vision,  mission  and 
principles,  an  IT  organization  will  more 
consistently  reflect  the  thoughts,  words 
and  deeds  of  its  leader— the  CIO.  “Not 
having  nearly  identical  communication 
and  action  is  what  causes  businesses  to 
question  CIO  authenticity,  integrity  and 
credibility,"  says  Poe. 
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Must-See  TV  Ads 


Blowing  Our  Own  Horn:  CIO  Wins  Honors  for  Excellence 


CIO  MAGAZINE  last  month  won 
top  honors  in  the  prestigious  Jesse 

H.  Neal  National  Business  Journal¬ 
ism  Awards  for  an  article  detailing 
the  disastrous  four-day  crash  of  a 
Boston  hospital’s  computer 
network.  The  article  from  CIO's 
Feb.  15,  2003,  issue,  “All  Systems 
Down,"  by  Senior  Editor  Scott 
Berinato,  won  the  Grand  Neal  as 
the  best  submission  in  the  field  of 

I, 282  entries. 


The  article,  which  judges  said 
impressed  them  with  its  "out¬ 
standing  marriage  of  practical 
information  and  thrilling  narra¬ 
tive,”  also  took  home  the  Neal 
award  for  best  single  article 
among  magazines  with  more  than 
$7  million  in  revenue.  In  addition, 
CIO  won  the  award  for  best  single 
issue  of  a  magazine  in  its  class  for 
the  Oct.  15,  2003,  issue  featuring 
the  cover  story  "The  Incredible 


An  idea  to  tailor  ads  to  individual 
viewers  raises  privacy  concerns 


AMERICANS  ARE  RUSHING  to  purchase 
digital  personal  video  recorders  like  TiVo 
so  that  they  can  zap  pesky  TV  commercials 
right  out  of  their  lives.  TiVo  sales  from 
August  to  October  alone  soared  73  percent 
compared  with  the  same  period  in  2002, 
and  the  commercial  television  industry  has 
good  reason  to  fear  that  devices  such  as 
TiVo  could  spell  the  demise  of  an  advertis¬ 
ing  gravy  train. 

Now  advertisers  are  testing  data-mining 
software  designed  to  get  through  to  TiVo 
users,  according  to  a  recent  story  in  Com¬ 
munications,  the  monthly  journal  of  the 
nonprofit  Association  of  Computing 
Machinery  (ACM).  But  the  software  that 
meets  Madison  Avenue’s  needs  could  create 
new  privacy  concerns  for  consumers 
because  it  can  profile  TV  viewers  and 
deliver  targeted  advertising  to  them  via 
their  beloved  TiVos. 

This  is  how  it  would  work:  The  TiVo 
would  record  its  patron’s  viewing  patterns, 
and  software  in  the  recorder  would  use 
statistical  models — together  with  any 
additional  information  collected  from  the 
viewer — to  develop  a  demographic  profile. 
“We  already  have  a  large  data  set  from  the 
Nielsen  Co.  that  shows  who  people  are, 
based  on  what  they  watch,”  explains 
William  Spangler,  assistant  professor  of  IT 


Shrinking  CIO,"  by  Senior 
Writer  Stephanie  Overby. 

This  is  the  second  year  in  a 
row  that  CIO  has  won  the  Grand 
Neal  in  the  contest  run  by  Ameri¬ 
can  Business  Media,  an  associa¬ 
tion  of  3,700  business-to-business 
magazines  and  online  titles. 

Continuing  CIO’s  roll,  the 
American  Society  of  Magazine 
Editors  named  CIO  a  finalist  in  the 
general  excellence  category  in  the 


at  Duquesne  University 
and  a  coauthor  of  the 
ACM  story.  “We 
know,  for  instance, 
that  people  who  tend 
to  watch  bass  fishing 
shows  weekly  and  golf 
and  the  sitcom  Friends 
are  men  aged  45  to  50 
with  a  certain  income.” 

After  profiling  the 
viewer,  the  system  would 
choose  specific  ads  from  a  stock  inventory 
and  download  those  to  the  individual’s  digi¬ 
tal  video  recorder  (DVR).  “Our  idea  is  that  it 
would  be  like  being  in  a  movie  theater,  when 
ads  are  presented  prior  to  actual  viewing  so 
they  don’t  intrude  on  the  viewing,”  Spangler 
says.  That  timing,  Spangler  hopes,  would  dis¬ 
tinguish  TiVo  ads  from  current  television  ads 
that  are  so  annoyingly  intrusive  that  they  set 
off  the  stampede  to  TiVos  in  the  first  place. 

Spangler  and  his  colleagues  at  Duquesne 
are  still  developing  statistical  models  that 
can  more  precisely  predict  the  demograph¬ 
ics  of  particular  viewers.  And  as  they  are 
quick  to  note  in  their  ACM  article,  there 
are  prickly  privacy  issues  that  must  be 
ironed  out  before  such  data-mining  tech¬ 
niques  can  be  applied. 

Spangler  says,  for  instance,  that  such  a 


2004  annual  National  Magazine 
Awards,  the  most  prestigious 
awards  program  in  the  magazine 
world.  The  winners  of  that  contest 
will  be  announced  May  5. 


device  could  work  only  with  an  opt-in 
process — consumers  would  have  to  agree 
to  receive  advertising  in  this  way  in  return 
for  some  incentives,  like  getting  a  better 
price  on  their  DVR. 

That’s  a  noble  thought.  But  the  recent 
history  of  online  data  mining  suggests  that 
entertainment  industry  executives,  rather 
than  embracing  the  idea  of  opt-in,  would 
inevitably  push  for  an  opt-out  policy  that 
leaves  it  to  individual  consumers  to  say 
they  don’t  want  their  viewing  habits  col¬ 
lected  in  large  databases.  It  could  end  up 
like  another  privacy  issue  for  legislative 
policy-makers  to  tackle.  The  Do  Not  Call 
list  has  been  a  hit.  Can  you  see  a  Do  Not 
Advertise  registry?  -Alison  Bass 


Compuware 


THE  POWERTO  Monitor,  Anticipate,  Resolve 

Monitor  application  performance  from  every  angle — from  the  end-user  perspective  and  back  through 
the  network,  to  the  server  and  database  tiers — with  Compuware  Vantage.  Anticipate  application 
bottlenecks  before  they  impact  business  processes.  End  the  fingerpointing  between  network,  server 
and  development  teams  and  bring  a 
new  balance  to  problem  resolution. 


COMPUWARE 

www.compuware.com 


saw  ts 

Em 

000? 

®  olS»\  0 

iSBBk  A 

^11 


Edited  by  Elana  Varon 


In  N.C.,  Technology 
Equals  Prosperity 

Senate  candidates  back  pro-tech  policies 


Another  Sarbox 
Reprieve 

After  Microsoft  letter,  SEC 
extends  compliance  deadline 


THIS  YEAR’S  North  Car¬ 
olina  Senate  race  pits  Rep. 

Richard  Burr — a  conserva¬ 
tive  Republican  advocate  for 
telecommunications  and 
biotech — against  moderate 
Democrat  Erskine  Bowles — 
an  investment  banker  with 
tech  industry  ties  who  was 
President  Clinton’s  chief  of 
staff.  Job  losses  in  a  tech- 
friendly  region  are  a  top 
concern  for  state  voters. 

North  Carolina  lost  more 
than  22,000  tech  jobs  in 
2001  and  2002,  according  to 
the  American  Electronics 
Association,  in  addition  to 
more  than  150,000  textile 
and  manufacturing  jobs  since 
1990.  “Economic  issues  are 
going  to  be  part  of  the  [cam¬ 
paign]  discussion,”  says  Thad  Beyle,  a  professor 
of  political  science  at  the  University  of  North  Car¬ 
olina  at  Chapel  Hill.  Burr  has  pushed  for  less  reg¬ 
ulation  of  the  telecom  industry  to  promote  jobs; 
Bowles  says  retraining  workers  and  enforcing 
trade  agreements  should  be  priorities. 

Burr,  now  serving  his  fifth  term  in  Congress, 
sponsored  a  1999  bill  establishing  a  biomedical 
imaging  and  bioengineering  center  at  the 
National  Institutes  of  Health,  which  Burr  says 
will  aid  early  cancer  detection.  The  health-care 
and  pharmaceutical  industries,  both  major 
employers  in  North  Carolina,  are  among  Burr’s 
top  contributors,  according  to  the  campaign 
finance  site  OpenSecrets.org. 

A  member  of  the  House  Energy  and  Com¬ 
merce  Committee,  Burr  says  minimal  regulation 
of  the  telecom  industry  will  encourage  investment 


in  a  fiber-optic  infrastructure 
for  the  Internet.  He  says  fiber¬ 
optic  cablemaker  Coming  has 
enough  plant  capacity  in  his 
state  to  cover  the  demand  for 
fiber  nationally — and  give 
North  Carolinians  jobs.  As  of 
February,  Burr  had  received 
nearly  $100,000  from  the 
telecom  industry.  When  it 
comes  to  outsourcing,  Burr 
says  he  would  consider  incen¬ 
tives  for  companies  to  shift 
jobs  to  low-cost  rural  areas. 

Bowles,  who  narrowly  lost 
the  2002  Senate  race  against 
Republican  Elizabeth  Dole, 
has  overseen  some  now- 
defunct  technology  compa¬ 
nies.  After  leaving  the  White 
House  in  1998,  Bowles  joined 
investment  banking  company 
Forstmann  Little,  through  which  he  served  as 
chairman  of  Metiom,  an  e-commerce  software 
company,  and  as  a  board  member  for  telecom 
vendor  McLeodUSA.  From  1999  to  2000, 
Bowles  chaired  the  North  Carolina  Rural  Pros¬ 
perity  Task  Force,  which  led  to  the  establishment 
of  a  commission  to  promote  rural  Internet  access. 

In  2002,  Bowles’  Democratic  primary  oppo¬ 
nents  criticized  his  support  for  Nafta,  saying  the 
1 993  treaty  cost  thousands  of  textile  and  man¬ 
ufacturing  jobs.  Now,  unions  are  among 
Bowles’s  top  contributors,  providing  $39,000  to 
date.  Michael  Brader-Araje,  a  Bowles  adviser, 
fund-raiser  and  software  entrepreneur,  says 
Bowles  wants  to  establish  workforce  training 
programs  to  offset  potential  job  losses  from 
trade  pacts  and  toughen  enforcement  of  existing 
agreements.  -Grant  Gross 


PUBLIC  COMPANIES  now  have 
until  Novemberto  comply  with 
Sarbanes-Oxley  provisions 
requiring  that  they  document  their 
internal  financial  controls.  CIOs 
can  thank  Microsoft. 

In  March,  the  SEC  extended  for 
the  second  time  the  deadline  for 
compliance  with  Section  404,  so  far 
the  most  expensive  and  IT-intensive 
part  of  law.  The  decision  was  in 
response  to  a  January  letter  drafted 
by  Microsoft  and  signed  by  its  CFO, 
along  with  the  CFOs  of  Cardinal 
Health,  Costco,  Procter  &  Gamble 
and  the  WD-40  company.  The  group 
argued  that  the  existing  June 
deadline  didn’t  allow  enough  time  to 
react  to  anticipated  rules  defining 
how  auditors  should  evaluate 
companies’  internal  financial 
controls.  Three  of  the  five  compa¬ 
nies,  including  Microsoft,  have  fiscal 
years  that  end  in  June.  The  others’ 
fiscal  years  end  in  August. 

The  five  companies  argued  that 
they  need  more  time  to  test  their 
systems  and  financial-reporting 
processes  against  the  new  stan¬ 
dard,  which  was  eventually  issued 
by  the  Public  Company  Account¬ 
ing  Oversight  Board  on  March  9. 
Says  Steve  David,  CIO  of  P&G:  “We 
don't  want  to  spend  extra  money  to 
prepare  for  something  that  won’t 
be  audited,  and  not  prepare  for 
things  that  will." 

It’s  no  coincidence  that  the  CIOs 
at  the  five  companies  are  involved 
with  Sarbox  compliance.  But 
Richard  Roth,  chief  research  officer 
with  the  Hackett  Group,  says  lots  of 
CIOs  are  still  out  of  the  loop.  Now, 
they  will  have  more  time  to  get 
involved.  -Ben  Worthen 
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A  CIO’s  Best  Friend 

CIO  honors  the  cowinners  and  honorable 
mentions  in  our  best  admin  contest 

IN  COLLECTING  CIOs’  NOMINATIONS  for  our  best  administrative  assistant  contest 
(in  honor  of  Administrative  Professionals  Day  on  April  21),  we  learned  that  CIOs  rely 
on  their  assistants  to  do  a  lot  more  than  screen  visitors  and  manage  schedules.  Our 
two  winners  share  a  crucial  quality:  They  are  essential  to  the  success  of  their  CIOs. 


Esther  Medrano 

Assistant  to  3Com  CIO  Ari  Bose; 
relies  on  trust  and  humortodo  her  job 


'hen  Medrano  read  about  this  CIO  magazine 
contest,  she  jokingly  told  her  boss,  Bose,  “Here’s 
your  chance  to  brag  about  me.” 

He  did  just  that,  touting  his  administrative  assistant’s 
ability  to  handle  his  hectic  travel  schedule,  to  manage  IT 
purchase  orders  and  other  IT  accounting  procedures,  and  to  ensure  he  has  rele¬ 
vant  information  and  time  to  prepare  for  meetings  with  senior  management. 
Most  important,  though,  Bose  says  that  “one  of  Medrano’s  greatest  strengths  is 
in  ensuring  the  confidentiality  of  information  she  has  access  to  and  treating  this 
in  a  very  professional  manner.” 

It’s  this  mix  of  trust,  professionalism  and  camaraderie  that  makes  a  great 
administrative  assistant  and  CIO  pairing.  One  that  can  guard  executive-level 
corporate  information,  but  also  joke  about  entering  her  for  this  award.  Medrano 
has  been  with  Bose  for  five  years  now,  starting  when  he  was  director  of  architec¬ 
ture.  Medrano  says  for  her,  the  key  to  being  a  good  administrative  assistant  is 
trust  and  communication.  She  says  Bose  is  her  boss,  but  also  her  friend. 


Margie  Brossett 

Assistant  to  Sears  senior 
VP  and  CIO  Garry  Kelly: 
acts  as  an  IT  information  hub 


How  good  would  it  be 
to  get  advance  word 
on  a  possible  e-mail 
interruption  or  immediate 
notification  about  systems  problems — not  only 
what  they  were  but  how  long  before  your  IT  team 
will  have  everything  running  smoothly  again? 

Those  are  some  of  the  many  things  Brossett 
does  that  make  Kelly  say  she’s  the  best  executive 
assistant  he’s  ever  had.  “Margie  runs  my  office 
efficiently  and  effectively,”  Kelly  says.  “I  couldn’t 
get  through  my  day  without  her.” 

No  wonder.  Brossett  acts  an  IT  hub,  sitting 
with  Kelly  on  a  floor  with  the  company’s  top 
management  (CEO,  CFO  and  nine  other  execu¬ 
tives)  and  managing  relationships  with  21  other 
administrative  aides  in  IT,  with  whom  she  keeps 
in  contact  about  meeting  project  deadlines  and 
arranging  troubleshooting  sessions.  She’s  a  fixture 
at  Sears,  having  started  more  than  30  years  ago  in 
the  accounts  payable  department  before  joining 
Kelly  in  2001.  Brossett  says  knowing  what  depart¬ 
ment — or  specific  person — to  contact  for  help  is 
crucial  to  her  and  Kelly’s  effectiveness. 

It  also  helps,  Brossett  says,  that  she  and  Kelly 
have  a  friendly  working  relationship  built  on 
professional  respect.  -Julie  Hanson 


CIOs  CAN  RELY  on  the  best  assis¬ 
tants  to  handle  multiple  tasks,  to  lead 
by  their  example,  and  even  to  manage 
budgets  and  IT  projects.  The  honor¬ 
able  mentions  in  our  contest  are: 

Terry  Bouslough,  executive 
assistant  to  Marguerite  Moccia,  CIO 
of  the  Bureau  of  Alcohol,  Tobacco, 
Firearms  and  Explosives,  is  a 
Toastmasters  veteran  who  uses  that 
experience  to  communicate  effec¬ 
tively  with  people  from  all  walks  of  life, 
winning  praise  from  the 
agency's  employees  and  the 
public  alike.  An  experienced 
administrator,  Bouslough  takes 
the  time  to  mentor  younger 
staff,  an  activity  that  makes  her 
popular  among  colleagues. 


Michelle  Cometa,  administrative 
assistant  to  Diane  Barbour,  CIO  at  the 
Rochester  Institute  of  Technology, 
started  her  job  about  20  months  ago, 
when  Barbour  was  reviewing  her 
organization.  The  result?  Cometa 
ended  up  taking  on  roles  that  would 
otherwise  have  gone  unfilled,  like 
producing  a  monthly  newsletter 
about  the  institute’s  IT  department 
and  a  series  of  technology  semi¬ 
nars  for  members  of  the  depart¬ 
ment.  Both  programs, 
Barbour  notes,  "have  been 
a  tremendous  success.” 

Dawn  Hill,  administra¬ 
tive  assistant  to  Thomas 
Jarrett,  CIO  and  secretary  of 
the  Delaware  Department  of 


Technology  and  Information  (DTI), 
has  managed  relationships  between 
her  office,  the  governor  and  the  state 
legislature,  earning  the  respect 
and  trust  of  policy-makers. 

“Dawn  inspires  others  in  DTI  with 
commitment,  enthusiasm,  extra 
effort  and  dedication.  She  is 
much  more  than  just  a  support 
staff  person  to  me,”  notes  Jarrett. 
"She  has  been  my  right  hand,  my 
mentor,  a  cheerleader  as  well  as  an 
anchor  when  needed.” 

Sandy  Sosa,  executive 
assistant  and  office 
manager  for  Michael  G. 
Williams,  vice  president 
and  CIO  at  The  New  York 
Times,  is  not  nicknamed 
"Ms.  Perfection”  for  nothing.  “She 
makes  me  look  good  by  saving  the 
company  big  dollars— doing  by 


herself  what  most  others  would 
outsource,"  Williams  notes,  adding 
that  Sosa  handles  event  planning  and 
travel  logistics  for  hundreds 
and  has  created  a  Lotus 
Notes  program  to  manage 
office  set-ups  for  new  hires 
at  the  newspaper. 

Man  Wang  ranks  as  the 
best  administrative 
assistant  that  Dennis  S.  Callahan, 
executive  vice  president  and  CIO  at 
Guardian  Life,  has  seen  in  a  37-year 
career  during  which  he’s  kept  as 
many  as  four  assistants  busy.  Wang 
exercises  flawless  judgment  in 
handling  sensitive  matters,  Callahan 
notes,  adding  that  she  manages  his 
calendar  and  global  travel  schedule 
so  that  "anyone  can  reach  me  when 
needed,  and  that  I  receive  mail  and 
important  messages  wherever  I  am.” 
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INTEGRATION:  THE  GATEWAY  TO 

Competitive 

Advantage 

Solutions  that  Turn  Your  Data  Challenges 
into  New  Business  Opportunities 

When  it  comes  to  honoring  business  ideas,  managing  information  for 
competitive  advantage  definitely  rates  a  gold  star. 

Information  today  is  increasingly  vital  to  companies.  Managed  wisely,  corpo¬ 
rate  information  yields  rich  resources  of  insight  to  help  companies  worldwide 
create  new  revenue  streams  and  enhance  existing  lines  of  business.  For  many 
organizations,  information  truly  is  the  most  valuable  asset  they  possess. 

But  to  harness  the  full  power  of  their  information,  companies  must  draw  from 
a  cohesive  body  of  business  data  that  is  linked  enterprise-wide.  That  calls  for 
data  integration.  Executives  cannot  mine  corporate  data  successfully  until 
they  integrate  disparate  systems  that  contain  that  data,  and  therefore  enable 
the  information  to  flow  freely  throughout  the  enterprise. 

For  many  executives,  one  of  the  pure  mandates  of  business  leadership  is  to 
make  data  more  effective  and  valuable.  "Data  management's  importance 
continues  to  escalate  in  today's  business  environments,  with  increases  in  data 
volume  and  support  for  multiple  data  sources.  Companies  now  seek  data 
integration  solutions  that  can  accommodate  these  broader  enterprise  needs," 
says  Doug  Laney,  VP  and  Director,  META  Group.  "Hybrid  data  integration 
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technologies  that  provide  a  single 
mapping  interface,  real-time  visual 
operations  management,  and  mul¬ 
tiple  data  integration  modes  will 
dominate  by  2006/07."  Moreover, 
as  new  regulations  regarding  the 
retention  and  management  of  cor¬ 
porate  information  take  hold, 
managing  data  wisely  becomes 
more  a  requirement  than  an  option. 

“Information  is  a  critical  factor,”  says 
Nigel  Stokes,  CEO  of  DataMirror, 
the  data  integration  and  protection 


Of  course,  there  are  a  number  of 
obstacles  in  the  path  of  executives 
who  seek  to  create  and  exploit  an 
integrated  flow  of  information 
throughout  their  companies. 

Among  them: 

Fragmented  Pools  of  Data 

Information  systems  have  grown  in 
functional  silos  over  the  years, 
using  incompatible  technology,  so  it 
can  be  difficult  to  retrofit  existing 
disparate  systems  to  integrate 
information.  To  create  one  consoli- 


Company-wide  Integration 
Strategies  Are  Difficult  to  Pull  Off 

Creating  and  building  an 
integration  effort  that  is  aimed  at 
addressing  system  and  informa¬ 
tional  integration  enterprise-wide 
can  be  both  expensive  and  compli¬ 
cated-causing  many  companies 
to  shy  away  from  the  concept. 

Integration  Solutions:  DataMirror 
Among  the  companies  chartered 
to  respond  to  the  integration 
challenge  is  DataMirror,  a  leading 


“Data  management's  importance  continues  to 
escalate  in  today's  business  environments.” 

—Doug  Laney ,  VP  and  Director,  META  Group 


solutions  vendor  based  in 
Markham,  Canada.  “Whether 
industry-specific  like  HIPAA  or 
wide-ranging  like  Sarbanes- Oxley, 
regulatory  compliance  raises  the 
profile  of  issues  relating  to  corporate 
governance  and  the  control  and 
monitoring  of  data,”  he  says.  “It’s 
absolutely  critical  that  companies  get 
control  of  their  integration  process.” 

The  Integration  Challenge 
Savvy  executives  today  recognize  that 
to  be  successful  in  the  Information 
Age,  their  companies  must  be  able  to 
leverage  an  integrated  informational 
environment.  In  fact,  data  integration 
regularly  appears  as  a  top 
priority  in  polls  of  information 
executives.  Also,  many  analysts 
report  that  data  integration  issues 
are  among  the  top  concerns  of 
their  clients. 

The  focus  makes  sense.  Software 
applications  are  increasingly 
becoming  the  repository  and 
primary  tools  for  meaningful 
information  analysis,  and  smart 
CIOs  realize  the  importance  of 
feeding  applications  with  real-time 
updated  transactional  data. 


dated  view  of  the  customer,  for 
example,  companies  would  need  to 
draw  information  from  order  entry, 
inventory,  accounting  and  customer 
service  systems,  just  to  name  a  few. 

Huge  Legacy  Investments 

While  it  may  be  tempting  to  solve 
the  problem  by  building  integrated 
systems  from  the  ground  up,  the 
reality  is  that  many  companies  have 
millions  of  dollars  invested  in  their 
current  infrastructure.  When  there 
are  already  systems  that  work,  it’s 
hard  for  CIOs  to  make  and  sell  a 
business  case  for  expensive  infra¬ 
structural  projects  that  lack  a 
defined  ROI. 

Difficult  to  Achieve  Real-time 
Information  Updates 

While  many  companies  do  have 
some  form  of  data  integration, 
much  of  it  is  not  based  on  up-to-the- 
minute  information.  Instead,  IS 
staffers  replicate  production  data  at 
intervals  into  a  user-accessible  data¬ 
base;  how  often  that  information  is 
updated  depends  on  the  company 
and  the  application.  Real-time 
updates  often  are  deemed  too  expen¬ 
sive  and  complicated  for  all  but  the 
most  mission-critical  applications. 


provider  of  live,  secure  data  integra¬ 
tion  and  protection  solutions. 
DataMirror’s  comprehensive  family 
of  LiveBusiness™  solutions  helps 
customers  easily  and  cost-effectively 
capture,  transform  and  flow  (CTF) 
data  throughout  the  enterprise. 

Attracted  by  DataMirror’s  long  history 
of  customer  satisfaction  and  financial 
stability,  along  with  its  technical 
excellence,  more  than  1,800  companies 
have  gone  live  with  DataMirror  soft¬ 
ware,  including  FedEx  Ground, 
Debenhams,  Tiffany  &  Co.,  and  Union 
Pacific  Railroad. 

Acushnet  Company,  a  golf  equip¬ 
ment  manufacturer  based  in 
Fairhaven,  Mass.,  used  DataMirror’s 
Transformation  Server  ™  to  integrate 
its  new  customer  portal.  “The  people 
who  helped  us  get  set  up  were  very 
professional,  and  the  software  works 
very  well,”  says  Acushnet  CIO  Peg 
Nicholson.  “It’s  been  one  of  the  most 
pleasant  experiences  I’ve  ever  had 
with  a  software  product.” 

Steve  Wallace,  CIO  of  Fairport, 
N.Y.-based  Constellation  Brands, 
a  leading  international  producer 


“The  right  time  isn’t  good 
enough;  real-time  is  what 
customers  need.” 

—Nigel  Stokes,  CEO,  DataMirror 


and  marketer  of  beverage  alcohol 
brands,  uses  DataMirror  software  to 
replicate  data  from  his  ERP  system. 
Before  signing  on  as  a  customer, 
Wallace  did  his  homework— and 
came  away  impressed  by  what  he 
learned.  “They’re  well  respected 
according  to  Gartner  analysis,” 
Wallace  says,  “and  they’ve  been 
around  for  a  pretty  long  time.  They 
are  one  of  the  larger  players.” 

Although  customer  service  and 
financial  stability  are  vital,  in  the 
end  the  products  have  to  live 
up  to  market  expectations,  and— 
according  to  testimonials— 
DataMirror’s  integration  products 
pass  the  test  with  flying  colors. 

The  key  is  DataMirror’s  dedication 
to  the  concept  of  real-time  integra¬ 
tion-something  many  companies 
want,  but  few  vendors  can  provide. 
“Real-time  information  flow  is  vital 
to  providing  a  competitive  advan¬ 
tage,  as  well  as  controlling  costs, 
data  monitoring  and  gaining  con¬ 
trol  of  the  customer  relationship,” 
says  Stokes.  “Most  successful  busi¬ 
nesses  are  differentiating  on  cus¬ 
tomer  experience  and  competing  by 
using  information  in  real  time. 
There’s  less  and  less  latency— the 
right  time  isn’t  good  enough;  real¬ 
time  is  what  customers  need.” 


with  the  company’s  production 
environment.  “We  wanted  to  give 
customers  the  ability  to  do  things 
like  place  orders,  pay  bills  and 
check  orders,”  says  Nicholson.  “We 
felt  it  was  the  next  frontier.”  For 
that  to  happen,  customers  needed 
to  see  information  that  was  up-to- 


the-minute— nothing  less  than  real¬ 
time  data  would  do.  “Why  would 
you  want  to  look  at  last  night’s  data 
when  changes  have  been  made  dur¬ 
ing  the  day?”  she  asks. 

Since  implementing  DataMirror’s 
solution,  Acushnet’s  customer 


CUSTOMER  PROFILE: 

Driving  Customer  Satisfaction  at  Acushnet 

For  Fairhaven,  Mass.-based  Acushnet  Company,  more  contact  with 
the  customer  is  always  better.  So  CIO  Peg  Nicholson  jumped  at  the 
chance  to  add  a  web  portal  to  her  company’s  arsenal  of  customer 
contact  points.  “Over  time  we’ve  moved  from  taking  orders  by  mail, 
to  phone,  then  fax  and  800  numbers,"  she  says.  With  14,000 
accounts  to  service,  “We  felt  that  the  next  frontier  was  the  web.” 

The  company,  which  makes  leading  golf  products  under  the  brand 
names  Titleist,  Pinnacle,  Cobra,  and  FootJoy,  also  wanted  to  be  able 
to  give  customers  an  avenue  to  approach  the  company  24/7.  “Many 
golf  pros  do  a  lot  of  selling  on  weekends,"  says  Nicholson.  “We 
wanted  them  to  be  able  to  enter  orders  for  custom  clubs  on  a  Saturday 
afternoon  if  that's  what  the  situation  called  for.” 

But  because  Nicholson  didn’t  want  customers  accessing  the  produc¬ 
tion  data  on  her  company's  AS/400,  she  turned  to  DataMirror  to  help 
populate  and  integrate  a  SQL  Server  for  the  customer  portal.  “We 
wanted  two-way  replication  so  we’d  be  in  sync  on  a  real-time  basis,” 
she  says. 


She  hasn’t  regretted  her  choice.  “We  found  the  product  to  be  very 
solid,”  she  says.  “For  what  we  wanted,  it  was  the  perfect  solution.” 

Her  customers  seem  to  think  so,  too.  “The  customer  response  has  been 
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CUSTOMER  PROFILE: 

Keeping  Data  Safe 
at  Constellation  Brands 

When  CIO  Steve  Wallace  began  a  rollout  of  J.D. 
Edwards  software  across  Constellation  Brands 
North  America,  a  leading  international  producer  and 
marketer  of  beverage  alcohol  brands,  such  as 
Corona  Extra,  Black  Velvet  and  others,  one  thing 
came  into  sharp  relief:  consolidating  the  regional 
smaller  databases  into  a  single  one  highlighted  the 
need  for  better  data  recovery. 

The  company,  with  $3.5  billion  in  sales  and  7,500 
employees,  needed  a  solution  that  would  work 
across  a  mixed-platform  environment,  and  would 
safeguard  the  vital  data  that  resided  on  its  ERP 
system.  Wallace  chose  DataMirror’s  Transformation 
Server  to  transfer  data  from  the  central  ERP  system 
to  a  data  warehouse  that  acts  as  a  mirror  site. 
“Transformation  Server  takes  real-time  transactions 
and  pushes  them  into  a  data  warehouse,”  he  says. 
“If  we  needed  to,  we  could  fail  over  onto  that  and 
keep  running.” 

Equally  important,  Wallace  relies  on  the  secondary 


data  warehouse  as  an  information  repository  that 
employees  can  query  without  impacting  performance 
on  the  main  database.  DataMirror  also  renames  the 
data  with  more  intuitive  names,  making  it  easier  for 
end  users,  and  does  it  all  in  real  time.  “Real-time 
information  is  important  for  a  number  of  reports  that 
we  run”  he  says.  "If  you’re  closing  the  books,  you 
need  immediate  numbers.  You  can’t  wait  for  the 
information  to  get  updated  at  night.” 

Wallace  plans  to  use  Transformation  Server  as  he 
extends  the  J.D.  Edwards  implementation  to  data 
centers  in  Europe  and  Australia.  “Each  will  have  a 
DataMirror  environment  for  local  business  intelligence 
and  data  recovery,”  he  says.  “We’ll  then  use 
Transformation  Server  to  push  consolidated  reports 
into  the  corporate  office  to  wrap  things  up.” 


response  has  been  tremendous.  “We 
have  more  than  5,000  customers 
who  use  the  system,  and  they  love 
it,”  Nicholson  says. 


Three  Keys  for 
Integration  Success 


Real-time  Data  Integration 

Give  users  the  best,  most 
current  data 


Multiple  Platform  Support 

Make  sure  you're  getting 
reports  from  all  enterprise 
systems 


Leverage  Legacy 
Technology 

Put  your  old  investments  to 
use  in  your  new  solutions 


Another  DataMirror  selling  point  is 
Transformation  Server’s  ability  to 
integrate  data  between  disparate 
databases.  “One  of  the  reasons  we 
like  DataMirror  is  that  we  have  a 
mixed  environment— AS/400,  Unix 
and  so  on— and  it’s  strong  on  run¬ 
ning  agents  on  all  the  platforms,” 
says  Constellation  Brands’  Wallace. 

Moreover,  DataMirror  products 
don’t  require  a  huge  infrastructural 
overhaul  because  they  work  easily 
with  existing  products.  “CIOs  can’t 
just  reinvest  in  new  software  pack¬ 
ages  to  get  better  integration.  They 
need  to  leverage  existing  invest¬ 
ments  in  technology  and  have  old 
and  new  coexist,”  says  Stokes.  “We 
give  the  ability  to  work  off  of  legacy 
systems  without  having  to  code  up 
to  new  standards.  To  be  practical, 
companies  have  to  deal  with  the 
past  and  the  future.” 


Integration  challenges  are  never  a 
simple  matter,  and  there  is  no 
one-size-fits-all  strategy.  CIOs 
must  carefully  consider  costs  and 
complexity  on  the  technology 
side,  and  weigh  them  against  the 
long-term  business  benefit  of 
having  vital  business  information 
flow  freely  throughout  the  enter¬ 
prise.  Choosing  the  right  solution 
only  maximizes  the  opportunities 
for  success. 


To  download  your  complimentary 
Livelntegration  Solutions  Kit,  visit 
www.datamirror.com/cio 
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In  order  to  ensure  a  true  peer  group  experience,  attendees  must  meet 
CIO  Executive  Programs'  qualifications. 
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Events  Trigger  Data 

A  flat  tire  shouldn't  let  the  air  out  of 
customer  service.  Sybase  Adaptive 
Server®  Enterprise  enables  your 
business  processes  to  respond  to 
exception  events  in  realtime. 


Data  Goes  Into  Action 


No  more  Information  lags.  Sybase  Real 
Time  Data  Services  proactively  pushes 
data  to  where  it's  needed,  when  it’s 
needed,  in  the  form  it’s  needed. 
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Sybase  Real  Time  Data  Services 
can  help  your  enterprise 
become  smarter,  faster,  and  more 
responsive.  Implementing 
a  real-time  initiative?  Start  with 
our  new  White  Paper. 


The  Enterprise.  Unwired 


Free  White  Paper 

www .  sy  ba  se .  com/  rts 


Data  Goes  To  The  Edge 


Real-time  data  everywhere.  Sybase 
mobile  middleware  and  mobile  databases 
enable  secure,  wireless  delivery  of 
relevant,  intelligent,  actionable  data. 


Data  Gets  A  Lot  Smarter 

Your  data  gets  smarter  every  step  of  the 
way.  Sybase  Integration  Orchestrator  links 
isolated  events  with  knowledge  and  then 
correlates  those  events  into  meaningful 
business  performance  metrics. 


The  Top  10  Drivers 
for  Innovation 

Council  members  offer  up  their  own  ways  of  fostering  an 
innovative  culture 

A  CIO  I  SPOKE  WITH  RECENTLY  says  he  has  had  it  with  technology.  “We  have  all  of  the  technology 
we  need,”  he  says.  “What  we  are  lacking  is  the  innovative  use  of  that  technology — that’s  the  really 
tough  part.”  I  asked  several  members  of  the  CIO  Executive  Council  to  talk  about  how  they  foster 
innovation  inside  their  own  companies.  According  to  Council  member  Stephen  Warren,  CIO  of 
the  Federal  Trade  Commission,  “Innovation  is  doing  something  in  a  new,  unexpected  way,”  he  says. 
“It’s  an  epiphany,  an  aha.”  But  contrary  to  popular  belief,  innovation  doesn’t  have  to  result  in 
business  transformation  or  a  huge  expense.  As  members  of  the  Council  demonstrate  below,  inno¬ 
vation  can  be  subtle,  manageable  and  a  core  part  of  the  IT  organization. 


TOP  o'  MiND 


THE  COMMUNITY  HAS  BEEN 
JAWING  ABOUT... 


RFID:  The  deadline  looms  large 

Single-instance  ERP:  Is  the 

bang  worth  the  buck? 

Linux  for  mission-critical 
projects:  What’s  the  real  ROI? 

Mergers  and  acquisitions:  Here 
we  go  again 

Going  global:  Big  challenges 
from  sourcing  to  systems 


YESTERDAY’S  NEWS 


Cutting  costs:  It’s  a  way  of  life. 
What’s  left  to  discuss? 


Editor’s  Note:  The  CIO  Executive 
Council  is  a  professional  organization 
for  CIOs.  Its  mission  is  to  leverage  the 
strengths  of  a  large  coalition  of  CIOs 
for  the  purpose  of  achieving  change 
within  our  organizations  and  shaping 
the  framework  for  the  future  of  IT.  For 
more  information  about  the  Council, 
go  to  www.cioexecutivecouncil.com. 


DELEGATE  THE  FIRE  FIGHTING.  “You  can¬ 
not  drive  innovation  while  you’re  putting 
out  operational  fires,”  says  Carl  Ascenzo,  CIO 
of  Blue  Cross  Blue  Shield  of  Massachusetts. 
“Hire  the  best  operations  team  you  can,  and 
stay  out  of  their  way.  ” 

2  ESTABLISH  CREDIBILITY.  Trust  breeds 
innovation,  and  communication  breeds 
trust.  Establish  a  formal  communication  pro¬ 
gram,  as  Jim  Burdiss,  CIO  of  Smurfit-Stone 
Container,  has  done.  “Our  Office  of  Continu¬ 
ous  Improvement  [OCI]  is  responsible  for 
communicating  with  the  enterprise  on  any¬ 
thing  that  has  a  technical  impact,”  he  says.  “If 
power  goes  down  at  a  plant,  the  OCI  lets  every¬ 


one  know.  Without  the  OCI,  we’d  have  a 
tougher  time  innovating.” 

ACCEPT  AND  SEEK  CRITICISM.  “Not 
every  idea  is  a  good  one,  and  some  are 
downright  lousy,”  says  Dave  Clarke,  VP  and 
CTO  at  the  American  Red  Cross.  “To 
improve  your  ideas,  ruthlessly  seek  out  criti¬ 
cism.  If  you  can’t  bear  to  hear  that  your  baby’s 
ugly,  you  won’t  be  a  successful  innovator.” 
PROVE  IT.  Does  the  idea  save  money? 
Does  it  increase  real  productivity?  Will  it 
work?  “Nothing  ruins  your  credibility  faster 
than  a  business  case  full  of  holes,”  says  Clarke. 
“Do  your  homework  and  get  some  feedback 
before  you  start  shopping  your  idea  around.” 
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Continental  Airlines  flies  24/7.  They  asked  Xerox  to  plot  a 
course  to  create  and  track  maintenance  advisories  digitally. 
Result?  Paper’s  eliminated.  Uptime’s  sky  high. 
There’s  a  new  way  to  look  at  it. 


Learn  more:  www.xerox.com/learn  Or  call:  1-800-ASK-XEROX  ext.  LEARN 
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5  LOOK  AROUND.  Staying  inside  your  organi¬ 
zation  and  keeping  the  lights  on  may  be 
instinctual  during  down  times,  but  it  is  hardly  a 
pathway  to  innovation.  “You  have  to  look  out¬ 
side  your  frame  of  reference,”  says  Kent  Kushar, 
CIO  of  E&J  Gallo  Winery.  “You  don’t  have  to  be 
the  first  wagon  out  of  the  fort,  but  if  you  want  to 
be  a  fast  follower,  you  have  to  get  out  there  with 
your  customers  and  see  what’s  going  on.”  The 
same  goes  for  your  staff,  says  Larry  Brown,  CIO  of 
Arch  Coal.  “The  people  in  the  trenches  need  to 
know  that  they  have  the  flexibility  to  look  at  inno¬ 
vative  alternatives.” 


6  AVOID  TECHNOLOGY  WORSHIP.  A  project 
need  not  involve  brand-new  technologies  to 
be  innovative.  “Stay  off  the  bleeding  edge,”  warns 
Jeff  Peterson,  CIO  of  UNICCO.  “Innovation  is 
much  more  likely  with  tested  and  proven  IT.  At 
UNICCO,  for  example,  we  used  a  low-end  portal 
toolkit  to  test  an  innovative  account-management 
concept  for  how  we  collaborate  with  our  cus¬ 
tomers.  After  receiving  overwhelming  interest  from 
our  customer  base,  we  moved  forward  with  Web¬ 
sphere,  a  proven  technology.” 

7  REVISIT  THE  STARTUPS.  In  addition  to  inno¬ 
vating  inside  their  own  companies,  CIOs  have 
a  role  to  play  driving  innovation  in  the  IT  industry. 
As  such,  they  need  to  start  priming  the  startup 
pump  again.  “We  all  need  to  open  the  door  a  little 
wider  for  the  startups  that  will  drive  the  next  gen¬ 
eration  of  external  innovation,”  says  Scott  Hicar, 
CIO  of  Maxtor.  “If  CIOs  can  collectively  agree  to 
take  at  least  one  startup  technology  into  consid¬ 
eration  for  your  portfolio,  the  stream  will  start 
flowing  again.” 


8  TIGHTEN  THE  PURSE  STRINGS.  “Constraint 
breeds  innovation,”  says  Clarke.  “It’s  very 
tempting,  when  money  and  resources  flow  freely, 
to  stick  with  tried  and  true  solutions.  When  money 
and  resources  are  constrained,  you  have  to  find 
new  and  creative  ways  to  solve  problems.” 

9  WATCH  YOUR  TIMING.  “Innovative  technolo¬ 
gies  are  like  a  joke.  It’s  all  in  the  timing,”  says 
Gene  Elias,  CIO  of  Quiksilver.  “Expecting  operat¬ 
ing  units  to  participate  in  a  new  project  at  the  drop 
of  a  hat  is  a  surefire  formula  for  failure.” 


-|  FIND  OPPORTUNITIES  IN  PROBLEMS. 

JL  Don’t  get  so  lost  in  a  problem  that  you 
miss  out  on  the  opportunity  it  provides.  “  Let’s  say 
an  application  fails  because  some  servers  are  mis- 
configured,”  says  the  FTC’s  Warren.  “While 
you’re  doing  a  physical  walk-down  of  your  infra¬ 
structure  to  solve  the  problem,  emerge  with  a 
baseline  architecture.” 


EXPERIENCE  BASE 

Innovation  Conies  in  All  Shapes 
and  Sizes 

Council  members  demonstrate  their  approaches 
to  innovation  in  these  five  projects 

Kent  Kushar,  CIO,  E&J  Gallo  Winery  PROFITABILITY 

ANALYSIS  TOOL  AT  E&J  GALLO  WINERY 

“We  developed  a  product  management  tool  called  the  Gallo  Edge  that  allows  chain 
stores  to  do  a  by-store,  by-bottle,  shelf-space  profitability  analysis.  The  innovation 
here  is  both  in  the  technology  itself  and  in  the  fact  that  we  are  providing  our  external 
customers  with  a  product  that  helps  them  get  smarter  about  their  business.  Make 
your  customers  smarter  about  your  whole  category,  and  they’ll  do  more  business 
with  you.” 

Carl  Ascenzo,  CIO,  Blue  Cross  Blue  Shield 
of  Massachusetts  competitive  collaboration  at  blue 

CROSS  BLUE  SHIELD  OF  MASSACHUSETTS 

“We  took  an  innovative  approach  to  application  development  by  partnering  with  a 
competitor  on  an  e-prescription  pilot.  The  application  allows  physicians  to  use 
handhelds  to  write  and  send  prescriptions.  By  getting  together  on  this  project,  we 
and  our  competitors  were  each  able  to  complete  the  rollout  in  less  time  and  for  less 
money,  and  push  the  industry  forward.” 

Earl  Monsour,  Director  of  Strategic  Technologies, 
Maricopa  Community  Colleges  wireless  lan  at 

CHANDLER-GILBERT  COMMUNITY  COLLEGE,  ONE  OF  10  MARICOPA 
COMMUNITY  COLLEGES  IN  ARIZONA 

"We  implemented  a  wireless  LAN  forthe  entire  college— all  campuses.  Access  is 
available  to  students,  faculty,  staff  and  administrators.  Although  there  are  already 
many  instances  of  pockets  of  wireless  access  at  other  organizations,  we  saw  the 
innovation  in  an  anytime,  anywhere  implementation.  This  was  a  true  team  effort 
involving  the  faculty,  staff  and  administrators  of  the  college.” 

Jim  Burdiss,  CIO,  Smurfit-Stone  Container  integrated 

ACQUISITION  PROJECT  PLAN  AT  SMURFIT-STONE  CONTAINER 

"We  developed  an  integrated  project  plan  for  a  very  large  acquisition.  We 
treated  business-process  change,  technical  change  and  training  as  one  large 
process,  with  IT  leading  the  charge.  We  completed  the  project  in  30  days  and  for 
$4.5  million,  when  a  silo  approach  would  have  taken  four  to  six  months  and  twice 
the  budget.” 


Scott  Hicar,  CIO,  Maxtor  self-service  kiosk  at  Maxtor 

“Working  with  our  customer  service  operations  team,  we  created  a  self-service 
kiosk  that  improved  the  customer  experience,  reduced  operating  costs  and  allowed 
the  call  center  to  invest  some  of  that  savings  in  additional  support  staff.  The  real 
innovation  lay  not  in  the  application  but  in  the  fact  that  we  were  able  to  make  solid 
improvements  within  the  environmental  constraints  of  the  last  two  years,  when 
most  companies  were  still  licking  some  expensive  e-business  wounds.” 
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RUN  EVERYTHING  FASTER. 


Detect,  diagnose  and  correct  application  performance  issues  before  they  become  business  problems.  Get  higher 
performance  from  all  of  your  applications,  databases  and  storage  arrays.  Software  for  Utility  Computing.  At  veritas.com 
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Charlie  Feld  I  Total  Leadership 


How  to  Build  a 
Great  Team 

Four  leadership  qualities 
for  getting  things  done 

PEOPLE  TEND  TO  THINK  of  a  leader  as  someone  who  can  set  the 
agenda.  But  the  real  value  of  leadership  lies  in  execution.  The 
key  difference  between  a  great  consultant  and  a  great  leader  is 
in  the  ability  to  turn  ideas  into  reality.  What’s  more,  while  ideas 
can  be  generated  by  an  individual,  execution  can  be  accom¬ 
plished  only  by  a  team  that  works  together. 

In  my  previous  column,  I  talked  about  the  key  competencies 
for  CIOs  to  be  able  to  create  a  compelling  business-technology 
proposition:  Great  pattern  recognition,  street  smarts  and  tech¬ 
nical  savvy.  An  additional  set  of  competencies  is  required  to 
build  a  great  team  that  is  skilled  and  loves  to  get  up  in  the  morn¬ 
ing  and  go  to  work.  These  competencies  are  more  like  qualities 
than  intellectual  or  managerial  traits.  They  include  character, 
leadership  development,  passion  and  influencing  skills.  Although 
these  qualities  are  seldom  emphasized  in  executive  performance 
objectives,  I  have  found  them  to  be  the  “secret  sauce”  of  great 
leaders  with  whom  I  have  worked  over  the  years. 

Character:  Doing  the  Right  Thing 

Character  has  been  described  as  ethical  behavior,  intellectual 
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integrity,  openness  and  honesty.  These  terms  have  come  to  the 
forefront  over  the  past  few  years — the  attention  spawned  by 
corporate  excesses.  Although  Sarbanes-Oxley,  corporate  gov¬ 
ernance  and  ethical  guidelines  are  top-of-mind  these  days,  they 
are  simply  table  stakes. 

My  definition  of  character  is  much  more  fundamental.  It  is 
what  you  do,  not  what  you  say.  I’ve  worked  for  and  with  many 
terrific  leaders  over  the  years  in  various  corporate  cultures. 
Some  of  these  leaders  were  collaborative,  others  were  direc¬ 
tive;  some  were  relaxed,  others  intense;  some  had  “command 
presence,”  while  others  were  quiet  and  calm. 

As  a  young  man,  I  found  it  very  curious  that  I  was  attracted 
to  so  many  diverse  leadership  styles.  As  the  years  went  by, 
though,  it  became  clear  to  me  that  style  had  little  to  do  with  it. 
The  common  ingredient  all  these  leaders  possessed  was  the 
substance  of  their  character.  No  matter  what  the  issue  or  the 
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A  NETWORK  OUTAGE  THREATENS 
TO  SHUT  DOWN  GLOBAL  DISTRIBUTION 
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X  THE  PROBLEM. 


CAN  YOUR  SOFTWARE  KEEP  BUSINESS  FROM  DISAPPEARING? 


Business  Service  Management  solutions  from 
BMC  Software®  can.  In  fact,  they  let  you  predict 
critical  performance  problems  and  resolve  them 
before  they  ever  impact  your  business.  And  you 
can  prioritize  IT  management,  investments  and 
resource  allocations  to  optimize  your  business 
performance.  So  you  can  solidly  align  your  IT 
investments  with  strategic  business  goals. 


And  protect  the  delivery  of  vital  business  services 
like  sales,  customer  service,  online  transactions, 
logistics  and  distribution  —  whatever  is  most 
critical  to  your  company's  success.  It's  enterprise 
management  software  that  works  with  your  existing 
IT  resources  to  let  you  manage  what  matters  from 
a  business  perspective  and  execute  with  precision. 
Find  out  how  at  www.bmc.com/bsm46 
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Charlie  Feld  I  Total  Leadership 


struggle  or  the  possible  personal  gain  or  loss,  they  always — not 
just  occasionally — did  the  right  thing.  Not  only  the  right  thing 
from  a  business  or  economic  aspect,  but  the  right  thing  includ¬ 
ing  social  and  philosophical  dimensions. 

This  consistency  of  character  is  hard  to  describe  but  easy  to 
recognize.  People  will  rally  around  leaders  who  do  the  right 
things  consistently.  They  know  they  can  count  on  their  leaders 
to  be  open  and  honest  at  every  fork  in  the  road  and  to  take  a 
stand  regardless  of  the  personal  risk.  When  people  feel  their 
leaders  are  erratic,  political  or  detached  from  them,  they  will 
become  cynical.  They  will  generally  do  their  work  but  won’t  be 
committed.  Their  trust  can  only  be  built  over  time,  so  don’t 
become  discouraged  if  people  take  a  “show  me”  attitude. 


opment.  It  will  pay  tremendous  dividends  and  help  give  you 
and  your  IT  organization  leverage  and  continuity. 

Passion:  The  Organizational  Energy  Level 

Passion  for  the  job  is  hard  to  manufacture,  but  when  present, 
it  is  contagious.  Enthusiasm  from  a  leader  enables  people  to 
sustain  themselves  through  demanding  times.  The  energy  level 
of  an  organization  is  set  at  the  top. 

It’s  hard  to  be  great  at  something  you  don’t  enjoy,  and  very 
few  great  things  are  accomplished  without  great  passion.  We 
see  it  in  sports,  communities,  businesses  and  individuals.  Don’t 
underestimate  the  value  of  passion. 

Influence  and  Persuasion:  Better  than  Power 


Leadership  Development:  The  Most  Important  Task 

The  second  competency  required  for  great  execution  is  develop¬ 
ing  the  leadership  skills  of  your  team.  Organizations  are  seldom 
led  by  a  single  person,  no  matter  how  charismatic.  The  team  at 
the  top  determines  the  environment  and  the  culture.  The  team 


Choosing  and  developing  your  leadership  team  is 
the  most  important  competency  of  a  leader.  This 
is  time-consuming— up  to  one-third  of  your  time. 


decides  what  gets  rewarded,  punished,  recognized  and  ignored. 
Although  they  don’t  run  all  of  the  plays,  they  call  the  plays. 

For  CIOs,  it’s  important  to  remember  that  the  team  at  the 
top  represents  and  reflects  your  character  and  agenda.  Regard¬ 
less  of  what  you  say  you  believe,  who  you  choose  for  your  IT 
leadership  team  speaks  more  loudly.  So  choosing  and  devel¬ 
oping  your  leadership  team  is  the  single  most  important  com¬ 
petency  of  a  leader.  This  is  a  time-consuming  task.  Many  great 
leaders  talk  about  spending  up  to  one-third  of  their  time  on 
leadership  development.  Since  no  one  is  perfect,  everyone  needs 
help  and  coaching. 

Developing  leaders  means  that  you  can  articulate  the  require¬ 
ments  in  a  clear  and  thoughtful  way.  Without  a  basic  frame¬ 
work  of  leadership  skills,  it’s  hard  to  evaluate  and  give  people 
feedback — and  without  constructive  feedback,  most  people  will 
not  change  and  grow.  When  I  was  at  PepsiCo,  developing  oth¬ 
ers’  skills  was  a  major  part  of  the  life  of  an  executive.  The  role 
models  were  plentiful,  leadership  competencies  were  well-known, 
feedback  was  continuous  and  growth  was  expected. 

Unfortunately,  most  people  deliver  feedback  only  once  a 
year  in  a  performance  evaluation,  rather  than  conducting  an 
ongoing  structured  development  effort.  I  encourage  you,  as  a 
leader,  to  make  the  investment  in  sustained  leadership  devel¬ 


CEOs,  CFOs,  CIOs  and  other  CXOs  have  inherent  positional 
power.  When  I  had  just  become  CIO  at  Frito-Lay,  I  would  some¬ 
times  say  something  without  much  thought.  The  next  thing  I 
knew,  people  were  actually  beginning  to  execute  on  one  of  those 
remarks — or  worse,  I  had  hurt  someone  with  an  offhand  com¬ 
ment.  I  began  to  realize  how  much  weight 
my  positional  power  carried. 

Executives  tend  to  think  it  is  much  eas¬ 
ier  and  less  time-consuming  to  just  tell  their 
direct  reports  what  to  do.  Part  of  leader¬ 
ship,  however,  lies  in  spending  time  to 
explain  a  directive,  in  giving  employees 
perspective  and  in  helping  them  under¬ 
stand  the  “why”  behind  the  direction.  This  is  influence — the  flip 
side  of  positional  power  It  is  easy  to  rely  on  positional  power  and 
forget  the  usefulness  of  influencing  skills. 

One  caution  on  the  use  of  influence:  There’s  a  presumption 
that  you  have  all  the  answers — and  you  will  set  out  to  per¬ 
suade  everyone  else  of  that.  But  a  great  leader  will  create  an 
involvement  with  his  staff  and  a  dialogue  on  decision  making 
because  the  door  swings  both  ways.  It’s  possible  that  you  are 
wrong  and  your  managers  have  a  better  idea.  Understand, 
however,  that  an  open  dialogue  doesn’t  relieve  you  of  the  lead¬ 
ership  responsibility  to  make  a  decision  and  move  the  team 
forward. 

This  group  of  competencies  is  what  it  takes  to  build  a  great 
team.  As  important  as  team-building  skills  are,  though,  they 
only  help  set  up  the  game.  In  my  next  column,  I  will  describe  the 
competencies  required  to  actually  play  the  game.  QEJ 


Charlie  Feld  is  the  former  CEO  of  the  Feld  Group,  a  CIO 
consultancy  that  was  acquired  by  EDS  in  January.  He  is 
now  executive  vice  president  of  portfolio  management  for 
EDS.  He  previously  served  as  CIO  for  First  Data  Resources, 
Delta  Air  Lines,  Burlington  Northern  Santa  Fe  Railway  and 
Frito-Lay.  He  can  be  reached  at  charlie.feld@eds.com. 
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INTRODUCING  INSIMBU 


THE  FASTEST  WAY  TO  MAKE  YOUR 
APPLICATIONS  PERFORM  TOGETHER 


Imagine  your  applications  -  both  legacy  and 
new  -  performing  together  as  an  ensemble. 

That  vision  can  become  a  reality  surprisingly 
quickly  with  Ensemble,  the  comprehensive  inte¬ 
gration  platform  with  all  the  functionality  you 
need  to  rapidly  complete  any  type  of  integration 
project  on  deadline  and  on  budget.  Even  complex 
projects  you  may  have  struggled  with  in  the  past. 

With  its  unique  fusion  of  powerful  technolo¬ 
gies  for  application  integration,  development, 
deployment,  and  management,  Ensemble  enables 
extremely  fast  integration  and  rapid  development 
of  “composite  applications”  -  new  business 
solutions  that  integrate  data,  orchestrate  business 


processes,  and  enhance  the  value  of  legacy  applica¬ 
tions.  You’ll  see  real-world  evidence  of  this  in  the 
customer  testimonial  section  of  our  web  site.* 

Ensemble  is  exciting  new  software  from 
InterSystems.  Over  the  past  twenty-five  years  our 
high  performance  products  have  been  deployed 
in  more  than  100,000  mission-critical  systems 
around  the  world. 

We’re  so  confident  that  Ensemble  is  drama¬ 
tically  faster  than  any  other  integration  technology, 
we’ll  be  happy  to  begin  our  partnership  with  you 
by  conducting  a  pilot  project.  To  pursue  this, 
contact  us  at: 

www.InterSystems.com/Ensemble/Pilot 


InterSystems 

E  ENSEMBLE 

Integrate  Applications  Faster 


*Read  how  companies  like  yours  have  integrated  applications  faster  with  Ensemble:  www.InterSystems.com/Ensemble/Customers 
If  you  are  a  System  Integrator  in  need  of  a  rapid  integration  platform,  come  to  www.InterSystems.com/Ensemble/Partners 
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Michael  Schrage  I  Making  IT  Work 

It  s  All  About  the  Execution 


Mad  as  Hell 

Readers  sound  off  on  CIO  leadership,  outsourcing  and 
the  IT  community’s  fading  commitment  to  quality 

READING  THE  RESPONSES  to  my  column  via  e-mail  and  CIO’s  online 
Add  a  Comment  inbox  brings  to  mind  Mark  Twain’s  venom- 
tipped  reaction  to  the  reelection  of  a  particularly  egregious 
scoundrel:  “The  people  have  spoken — the  bastards!” 

Not  that  any  of  my  readers’  insights  are  illegitimate  in  any 
way,  of  course,  but  it  is  fascinating  to  observe  what  gets  the 
CIO  community  hot  and  bothered  and  what  wins  its  compli¬ 
ments.  So  this  column  is  about  what  I’ve  been  learning  from 
your  feedback. 

The  obvious  problem  with  columns  like  this  is  that  the  sam¬ 
pling  of  opinion  is  so  skewed.  The  Outraged,  Infuriated  and 
Upset  who  think  you  a  moron  are  far  more  likely  to  comment 
than  the  Nice  Column  folks.  Indeed,  “Liked  the  column”  e- 
mailers  are  lovely — but  reveal  little — while  the  readers  who 
think  your  cerebellum  is  a  total  waste  of  neurons  vituperatively 
go  to  great  lengths  to  explain  why  your  ideas  are  moronic. 
Sometimes  they’ve  even  got  a  point. 

The  best  feedback  comes  from  people  who  have  a  story  to 
relay,  an  experience  to  share  or  a  question  to  ask  that  forces  me 
to  rethink  why  I  wrote  what  I  wrote.  Because  this  is  a  column 


about  the  challenge  of  IT  implementations,  rather  than  the 
wonderfulness  of  Big  IT  Ideas,  you  have  to  take  people’s  real 
world  observations  more  seriously. 

The  readers  who  respond  to  this  column  are  typically  intelli¬ 
gent,  articulate,  concerned  about  their  professional  futures  and 
frustrated  by  how  difficult  it  is  to  work  productively  with  their 
business  counterparts.  My  columns  are  often  criticized  not  for 
sounding  jaundiced  or  cynical  but  for  not  being  cynical  enough! 

Intriguingly,  the  columns  that  get  the  most  intense  feedback 
are  the  ones  in  which  I  argue  that  CIO  leadership  means  hav¬ 
ing  the  courage  to  decide  where  IT  shouldn’t  be  a  leader  in 
organizational  change.  Few  things  undermine  legitimacy 
quicker  than  trying  to  do  too  much.  Overextended  IT  organi¬ 
zations  typically  end  up  with  the  worst  of  both  worlds:  over¬ 
promised  expectations  and  underdelivered  implementations. 

That  sort  of  CIO  critique  drew  a  lengthy  diatribe  from  Jim 
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You  designed  your  network  to  make 
your  company  more  efficient.  Now  you  can 
do  the  same  thing  for  your  documents. 

If  your  company  has  recognized  that  the  network  can  help  improve  document  efficiency,  now’s  the  time  to 
speak  with  IKON.  Our  systems  professionals  work  with  you  to  address  inefficiencies  and  develop  and 
implement  integrated  solutions  that  combine  the  best  hardware,  software  and  services.  As  the  world’s 
largest  independent  document  services  and  equipment  provider,  IKON  offers  product  lines  from  leading 
manufacturers  including  Canon,  Ricoh  and  HP.  And  we  have  Systems  Analysts  and  7000  service  technicians 
that  are  second  to  none.  Looking  for  document  efficiency  on  your  network?  Look  no  further  than  IKON. 
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Storing  these 
electronically 
would  make  them 
easier  to  access. 


Michael  Schrage  I  Making  IT  Work 


Wells,  a  CIO  with  a  large  health-care  organization  in  the  Mid¬ 
west  (reprinted  with  his  kind  permission),  that  captured  the 
sentiments  of  many  stalwart  CIO  champions.  Wells  wrote: 

“CIOs  who  have  not  established  policies  and  procedures  to 
prevent  departments  from  going  their  own  way  are  not  CIOs; 
they  are  directors  or  managers,  whatever  they  call  themselves. 

“CIOs  [who]  do  not  report  to  the  CEO  are  not  CIOs;  they 
are  directors  with  a  fancy  title  and  salary. 

“CIOs  who  do  not  enable  (now  that  is  another  buzzword 
that  academic  and  consulting  types  love  but  has  no  real  meaning) 
are  not  CIOs.  CIOs  should  run  for  office  as  that  is  how  they 
must  spend  their  days  in  order  to  stay  employed.  The  prime  role 
of  a  CIO — for  those  who  have  never  served  in  the  trenches — is 
to  determine  what  is  needed,  wrap  this  into  a  flexible  strategy, 


Feeling  betrayed  by  their  bosses  and  their  clients,  IT 
workers  are  becoming  more  ambivalent  about  investing 
themselves  in  their  implementations.  After  all,  quality 
implementations  make  outsourcing  easier  to  accomplish. 


present  this  strategy  to  his  boss  (the  CEO)  and  then  present  it  to 
the  executive  (not)  team,  the  executive  steering  committee  (said 
governing  body  duly  formed  by  the  CIO,  chaired  by  the  CIO,  and 
a  fully  representative  body  of  all  disciplines). 

“As  the  ‘guru  of  technology,’  it  is  the  role  of  the  CIO  to  intro¬ 
duce  business  change  through  the  use  of  technologies — not  just 
the  darling  of  the  e-commerce  world’s  current  buzzword,  but  all 
technologies.  If  crucial  changes  need  to  be  made  to  basic  tech¬ 
nologies  in  order  to  take  advantage  of  newer  ones,  so  be  it. 

“The  CIO  is  a  mentor,  internal  consultant  and  teacher.  If 
the  CIO  is  not  comfortable  with  all  of  these,  then  get  a  job 
selling  used  cars.” 

Mr.  Wells  did  not  respond  when  I  pointed  out  that  his  rather 
idealistic  RFP  for  top  IT  executives  would  effectively  exclude 
over  half  the  CIOs  who  read  this  magazine. 

But  that  obscures  the  larger  point:  The  post-bubble,  outsource- 
driven,  but-just-how-much-should-IT-matter?  world  has  created 

a  level  of  fear  in  the  higher  echelons 
of  the  IT  ranks  that  makes  Edward 
Yourdon’s  ominous  and  terribly 
timed  Decline  and  Fall  of  the  Amer¬ 
ican  Programmer  (a  book  that 
came  out  in  1992  before  the  Inter¬ 
net  boom)  read  like  a  happy  pre¬ 
quel  to  Who  Moved  My  Cheese ? 
Everybody  still  agrees  that  IT 
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Michael  Schrage  says  that  IT 
workers  are  feeling  that  their  CIOs 
have  given  up  on  them  as  part¬ 
ners.  And  that  will  hurt  the  quality 
of  their  work.  What  do  you  think? 
Go  online  to  post  your  reactions  in 
the  ADD  A  COMMENT  box  at  the 
end  of  this  article. 
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remains  a  growth  industry  that  continually  renews,  refreshes 
and  extends  the  business  capabilities  of  the  enterprise.  It’s  just 
that  IT  may  no  longer  be  a  growth  industry  for  IT  staff  as  indi¬ 
viduals.  In  other  words,  there’s  a  feeling  that — pincered  between 
India  and  automation — their  IT  future  is  more  like  the  “sili¬ 
con  collar”  than  a  profitable  profession  with  harder  work,  less 
security  and,  of  course,  less  money  than  before. 

Even  worse,  IT  workers  are  feeling  that  their  CIOs  have 
given  up  on  them  as  partners.  Look  at  the  comments  posted 
after  my  “Memo  from  the  Future”  (see  www.cio.com/print- 
links)  and  one  can  practically  smell  the  unhappiness.  These 
aren’t  primarily  CIOs  responding,  mind  you;  they’re  the  people 
who  report  to  and  work  with  the  CIOs. 

What’s  the  takeaway  for  the  CIO  reader?  That  the  IT  com¬ 
munity’s  commitment  to  qual¬ 
ity  implementation  seems  to 
be  fading.  People  are  becom¬ 
ing  more  ambivalent  about 
investing  themselves  in  their 
IT  implementations. 

Why?  Many  hard-work¬ 
ing  IT  people  fear  that  qual¬ 
ity  implementations  will 
make  them  less  indispensable 
to  the  organization  rather  than  more  so.  They’re  afraid  that 
their  CIOs  are  using  them.  Indeed,  quality  implementations 
make  outsourcing  the  implemented  app  or  system  easier  to 
accomplish. 

Even  worse,  they  feel  that  their  clients  and  customers  are 
looking  at  them  less  as  partners  than  as  expensive  “necessary 
evils”  that  must  be  tolerated.  At  least,  until  the  implementation 
is  complete  or  the  whole  thing  can  be  outsourced  or  automated. 

The  idea,  the  notion,  the  very  possibility  that  an  implemen¬ 
tation  becomes  both  a  source  of  insight  and  a  platform  for 
future  enhancements  and  refinements  is  ignored.  Somehow,  the 
belief  that  once  an  app,  a  system  or  a  capability  is  “designed,” 
all  that’s  left  is  the  nitty-gritty  of  “implementation”  has  become 
a  dogma  in  certain  digital  circles.  Please  reread  Mr.  Wells’s  com¬ 
ments;  implementation  is  irrelevant. 

The  people  who  are  sending  me  e-mail  and  posting  com¬ 
ments  are  in  pain.  They  are  feeling  betrayed  by  their  bosses 
and  by  their  clients.  They’re  questioning  their  economic  value 
as  “implementers”  in  an  era  where  implementation  is  over¬ 
whelmingly  perceived  as  a  “cost.”  They’re  worried.  So  am  I. 
You  should  be  too.  HE] 


Michael  Schrage  is  codirector  of  the  MIT  Media  Lab's 
eMarkets  Initiative.  He  can  be  reached  at  schrage@ 
media.mit.edu.  Please  send  your  comments  to  us  via 
e-mail  at  letters@cio.com. 
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“Have  you  considered  standardizing 
your  JCL  and  batch  processes? 
Doing  it  now  will  pay  great 
dividends  in  the  future.” 


Lowell  Sando 
Founder  and  CTO 
Diversified  Software 


Timing 

is  Everything 

Have  you  been  putting  off  a  JCL  tune  up  project?  Perhaps 
now  is  the  time  to  start.  Whether  you  want  to  do  the  work 
yourself  or  want  some  help  from  the  JCL  specialists, 
Diversified  Software  can  assist  you.  From  providing  the 
world's  leading  JCL  management  software  products,  to 
complete  refurbishment  services,  we  customize  our 
solutions  to  meet  your  expectations  and  budget. 

How  can  Diversified  Software  help  solve  Your  JCL  needs? 
Contact  us  at: www.diversifiedsoftware.com/jcl  or 
call  us  at  408.778.9914 
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Cover  Story  |  Security 


Physical  and  information  security  have  been  converging,  often  under 
the  control  of  IT.  But  companies  are  increasingly  moving  the  job  of 
policing  security  out  of  IT  and  into  the  hands  of  an  independent  CSO. 
Here’s  why  you  should  consider  doing  the  same. 

BY  CHRISTOPHER  KOCH 


FOR  40  YEARS  there  has  been  little  reason  for  any¬ 
thing  computer  related  to  fall  outside  IT’s  command.  But  that  era 
is  coming  to  an  end.  The  evolving  and  increasingly  important  role 
of  information  security  requires  the  background  of  a  geek  and  the 
instincts  of  a  cop.  Information  security  crashes  together  two  func¬ 
tions:  traditional  corporate  security  and  IT.  The  ex-cops  over  in 
corporate  security  who  watch  the  doors  and 
suspicious  behavior  are  using  more  and  more 
technology  to  get  their  jobs  done.  And  the 
stakes  in  an  IT  security  breach  have  risen  so 
high  that  IT  people  who  know  firewalls  but 
can’t  fathom  the  motives  of  a  disgruntled 
employee  are  no  longer  able  to  protect  their 
companies  from  what  could  be  serious 
financial  losses,  extended  network  down¬ 
time  and  badly  damaged  relationships  with 
customers. 


So  struggle  over  who  gets  information  security  is  growing:  IT, 
the  traditional  security  group  or  a  new  function  that  is  distinct 
from  both  groups.  There  is  already  clear  evidence  that  IT  is  going 
to  lose  the  fight — and  more  important,  that  it  should.  In  an  Octo¬ 
ber  2003  CIO  magazine  survey,  respondents  who  described  them¬ 
selves  as  “very  confident”  in  their  companies’  security  were  nearly 
twice  as  likely  to  have  information  security 
reporting  outside  of  IT  than  those  who  described 
themselves  as  “not  at  all  confident”  in  their  secu¬ 
rity.  The  reasons  for  the  confidence  are  clear: 
Confident  companies  suffered  nearly  six  times 
fewer  security  events,  had  less  downtime  and  uj 
fewer  financial  losses  than  the  less  confident  com-  > 
panies.  And  they  allotted  more  money  toward  In¬ 
security:  The  percentage  of  the  IT  budget  that  £ 

CD 

confident  companies  spent  on  security  was  dou-  £ 
ble  that  of  the  not  confident  group  (14  percent  £ 


Reader  ROI 

►  Why  many  CIOs  should 
push  the  responsibility  for 
protecting  security  out  of  IT 

►  How  some  CIOs  and  CSOs 
work  together  to  set  secu¬ 
rity  policies 

►  Why  CSOs  should  report  to 
a  business  executive  such 
as  the  COO  or  CFO 
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Capital  IQ  CTO  William  Murphy  (right) 
says  he  lobbied  for  the  hiring  of  CSO 
Ken  Pfeil  (left)  in  order  to  make  security 
a  "competitive  advantage”  for  his 


company. 


Cover  Story  |  Security 


10  Ways  to  Tell  You  Need  an  Independent  CSO 

Deciding  whether  you  need  an  independent  chief  security  officer  is  a  balance  of  four  issues:  The  number  of 
external  privacy  and  security  regulations  you  face,  the  size  of  your  customer  base,  the  number  of  internal  employees 
and  the  degree  of  privacy  and  security  that  customers  demand  for  your  information— for  example,  financial  services 
and  health  care  face  high  demands  in  this  regard.  When  these  factors  change  or  get  out  of  whack,  it  may  be  time  to 
carve  out  a  separate  CSO  role  that  reports  outside  of  IT.  Here  are  some  clear  warning  signs  that  say  you  need  a  CSO. 


*1  You’ve  lost  track  of  what  you 

£“  Your  competitors  start  using 

Q  Data  has  not  been  segmented 

X  have  in  the  infrastructure. 

\J  their  success  with  security  as  a 

O  into  more  secure  and  less  secure. 

The  company  has  grown  a  lot 

competitive  weapon  against  you. 

ts  Every  manager  and  employee 

or  changed  its  business. 

r*  The  company  doesn’t  have  an 

doesn’t  believe  that  security  risk 

O  Your  customers  demand  extra 

O  explicit  written  security  policy 

is  real,  close  by  and  imminent. 

O  privacy  and  security. 

or  can’t  enforce  the  one  it  has. 

i  A  major  security  incident  has 

A  You  weren’t  regulated  and 

“*7  Outsourcing  deals  haven’t  been 

X  xJ  happened,  and  you  need  to 

/i  & 

“  now  you  are,  or  the  regulations 

/  examined  for  security  issues. 

rebuild  trust  with  customers. 

have  changed. 

-C.K. 

versus  7  percent),  and  they  paid  more  attention  to  organizational 
reporting  and  security  policy  issues. 

There  are  other  reasons  to  move  security.  Some  argue  that 
keeping  responsibility  for  policing  security  within  IT  can  pose  a 
potential  conflict  of  interest  for  the  CIO,  who  may  be  tempted  to 
give  short  shrift  to  security  concerns  in  favor  of  getting  IT  projects 
in  on  time  and  under  budget.  And  catching  hackers  requires  the 
ability  to  think  like  a  criminal,  something  IT  employees  are  not 
trained  to  do.  Then  there’s  the  workload  issue:  Don’t  CIOs  have 
enough  on  their  plates  these  days  without  having  to  deal  with  the 
burgeoning  and  evolving  challenge  of  worrying  about  all  aspects 
of  a  company’s  security?  Having  security  responsibilities  reside  in 
the  hands  of  a  CSO  or  equivalent — and  in  particular  someone 
who  reports  outside  of  IT — could  be  better  for  the  CIO’s  career 
and  the  health  of  the  IT  group  as  well  as  the  overall  organization. 
A  CSO  can  focus  full-time  on  security,  unlike  a  CIO  who  is  often 
pulled  in  several  different  directions. 

But  the  issue  is  still  up  for  debate.  Some  CIOs  are  concerned 
that  if  security  policy  is  moved  out  of  the  IT  department,  they 
would  lose  influence  but  still  be  held  accountable  if  something 
goes  wrong.  CIOs  for  small  and  midsize  companies  argue  that 
it’s  not  practical  to  create  a  separate  role  that  is  responsible  for 
security.  And  CIOs  in  industries  heavily  regulated  by  the  federal 
government  also  worry  that  letting  go  of  security  could  mean 
falling  out  of  compliance. 

With  the  debate  raging,  if  you’re  not  seriously  examining 
where  information  security  falls  on  your  org  chart,  it’s  time  to  do 
so.  And  there  is  mounting  evidence  that  owing  to  its  growing 
complexity  and  importance  to  besieged  organizations,  security 
probably  should  be  separate  from  IT.  The  dialogue  about  the 


future  of  IT  security  is  just  beginning.  Chances  are,  the  discus¬ 
sions  should  be  going  on  inside  your  company  too.  In  this  story, 
we’ll  outline  the  main  issues  to  debate. 

CUT  SECURITY  LOOSE 

Security  experts  say  that  most  IT  security  threats  are  from  within 
the  company.  If  that’s  the  case,  then  keeping  IT  security  within  IT 
is  a  simmering  conflict  of  interest.  “If  you  think  of  information 
security  as  a  policing  function,  then  having  [security  staff]  report 
to  the  CIO  has  the  IT  infrastructure  policing  itself,”  says  Bill  Sper- 
now,  a  security  consultant  and  former  chief  information  security 
officer  of  the  Georgia  Student  Finance  Commission.  Samantha 
Thomas,  director  of  the  information  security  office  for  the  Cali¬ 
fornia  State  Teachers’  Retirement  System  (CalSTRS)  puts  it  more 
starkly:  “If  you’re  in  IT  and  they’ve  given  you  security,  how  can 
you  conduct  an  unbiased  investigation  of  the  friend  you’ve  sat 
next  to  for  years  ?  ”  Thomas  and  her  fellow  CISOs  in  all  California 
state  departments  now  report  to  their  department  chiefs  because 
of  an  executive  order  from  then-Gov.  Gray  Davis  in  2002. 

Those  who  advocate  moving  security  out  of  IT  say  that  new, 
complicated  challenges  require  someone  who  can  look  at  the  big¬ 
ger  strategic  picture  of  security  across  the  company,  advocate  for 
tougher  security  measures  in  all  functions  of  the  company  and 
report  security  issues  to  a  higher  authority  than  the  CIO. 

These  are  the  issues  that  made  William  Murphy,  CTO  of  finan¬ 
cial  data  and  analytical  software  provider  Capital  IQ,  ask  his 
company  to  hire  a  CSO  in  2002.  “I  had  handled  security  ade¬ 
quately  since  the  company  began  in  1998,  but  I  wanted  security 
to  be  more  than  adequate;  I  wanted  it  to  eventually  become  a 
competitive  advantage  for  us,”  says  Murphy.  The  growth  of  the 
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company  (from  five  people  when  Murphy  started  to  900  today) 
combined  with  a  growing  customer  base,  a  much  broader  prod¬ 
uct  line  of  security-sensitive  products  and  customers  that  had 
increasing  security  expectations  sparked  the  switch. 

But  Murphy  says  he  also  felt  ethically  compromised — not  to 
mention  overworked — by  hanging  on  to  security.  He  specifically 
requested  that  the  new  CSO  report  to  a  managing  principal,  not 
him.  “I  said,  ‘I  don’t  think  the  CSO  should  report  to  me  because 
I  have  competing  motivations,’”  he  recalls.  “As  a  CT  O  you  have 
these  constant  internal  pressures  to  get  functionality  out  and  keep 
performance  high  and  all  these  other  typical  IT  issues.  And  it’s 
too  easy  to  push  security  to  the  side.  I  felt  like  Dr.  Jekyll  and  Mr. 
Hyde,  constantly  trying  to  do  in-the-moment  risk  analysis  on 
things”  from  the  typical  performance  issues  on  the  one  hand  and 
security  on  the  other.  “I  felt  like  I  needed  a  church  and  state  sep¬ 
aration,”  he  adds.  “Security  and  IT  should  be  like  the  Supreme 
Court  and  the  executive  branch.  You  want  them  to  work  together, 
but  you  want  that  independent  oversight  into  what  you’re  doing 
so  that  you  don’t  make  bad  decisions.  I  just  don’t  believe  that  put¬ 
ting  that  much  power  in  one  person’s  hands  is  the  right  thing  for 
shareholders.”  Murphy  says  the  new  setup  is  effective. 

Siemens,  the  German  manufacturing,  IT  and  services  giant, 
had  this  epiphany  eight  years  ago,  according  to  Harald  Hoefler, 
CIO  of  Siemens  Canada.  Information  security  has  reported  to 
the  CFO’s  office  ever  since.  “If  the  CSO  reported  to  the  CIO,  secu¬ 
rity  would  not  be  strong  enough,”  says  Hoefler.  The  CSO  has 
two  primary  roles  at  Siemens:  To  secure  the  systems  and  to  audit 
them  for  adequate  security.  The  CSO  can  do  neither  well  without 
independence  from  the  CIO,  Hoefler  argues.  “Say  I  have  prob¬ 
lems  with  the  network  and  I  haven’t  done  my  work  correctly,”  he 
says.  “If  I  have  this  information  security  officer  in  my  area,  he’d 
point  it  out,  but  I’d  try  to  fix  the  problem  in  a  way  that  it  doesn’t 
get  [revealed  to  the  other  top  executives].  What  you  want  is  to 
have  all  the  top  executives  aware  of  the  problems  and  working 
together  to  fix  them.”  Hoefler  says  that  kind  of  disclosure  and 
cooperation  can  occur  only  when  security  reports  to  an  execu¬ 
tive  with  broad  managerial  responsibilities  for  the  company  as  a 
whole,  like  the  CEO,  CFO  or  COO.  “The  CFO  is  in  a  position  to 
influence  all  the  C-level  managers  and  get  the  budget  to  do  [infor¬ 
mation  security],”  adds  John  Pomeroy,  CSO  for  Siemens  Canada. 
Though  different  divisions  of  Siemens  handle  the  specific  security 
role  differently,  increasingly  the  divisions  are  combining  infor¬ 


mation  and  traditional  corporate  security  under  a  CSO,  like 
Pomeroy,  who  reports  to  the  CFO. 

MOVE  ACCOUNTABILITY 

Of  course,  it’s  one  thing  to  transfer  responsibility  for  information 
security  outside  IT,  but  if  accountability  doesn’t  move  with  it,  the 
CIO  will  be  in  big  trouble.  That’s  why  some  CIOs  do  not  even 
want  to  consider  letting  go  of  information  security.  “Even  if  IT 
security  was  moved  out  of  IT,  if  something  happened,  I  would  still 
be  on  the  hook,”  says  Tom  Smith,  former  CIO  of  Waste  Man¬ 
agement,  who  retired  in  March.  “I  think  IT  security  is  part  of  a 
CIO’s  role  and  responsibility  as  opposed  to  a  conflict  of  interest. 
I  feel  personally  responsible  for  internal  IT  security,  whether  it  be 
physical  security  or  data  security.  To  delegate  that  to  a  third  party 
such  as  another  security  group  outside  of  IT,  I  just  think  it’s  the 
wrong  thing  to  do.  ” 

But  proponents  of  jettisoning  security  out  of  IT  disagree.  “I 
hear  that  concern  100  percent,”  says  Capital  IQ’s  Murphy.  “But 
when  there  is  a  breach,  the  CSO  and  I  go  to  the  CEO’s  office 
together.  It’s  a  teamwork  issue.  It’s  not  ultimately  who’s  on  the 
hook  for  something — it’s  a  question  of  having  people  full-time 
worried  about  security  versus  IT.  It’s  the  future  of  the  company,  and 
as  executives  you  should  both  be  accountable.”  Murphy  says  he’d 
rather  have  Capital  IQ’s  CSO,  Ken  Pfeil,  go  with  him  to  see  the 
CEO  than  go  by  himself. 

When  a  CIO  keeps  information  security  inside  IT,  even  if  he 
creates  a  CSO-type  role,  he  is  much  less  likely  to  seek  someone 
from  outside  the  department  or  the  company  to  cast  a  fresh  eye  on 
the  ways  the  company  handles  security,  says  Spernow.  The  CIO  is 
more  likely  to  give  it  to  a  trusted  lieutenant  who  shares  the  same 
views  on  security  that  he  does.  “How  many  bosses  are  going  to  be 
receptive  to  the  information  security  person  saying  here’s  how 
you’re  screwing  up?  They  can’t.  It’s  just  human  nature,”  says  Sper¬ 
now.  “Typically  CSOs  are  best  when  they  come  from  the  outside 
because  they  have  to  be  a  change  agent,  and  if  you’re  bringing  the 
baggage  of  people  you  owe  favors  to,  it’s  tough.” 

THINK  LIKE  A  CRIMINAL 

When  corporate  security  began  to  be  a  distinct  function  in  most 
companies  during  the  ’50s  and  ’60s,  companies  usually  wanted 
someone  experienced  at  looking  for  and  handling  bad  guys — 
former  cops,  mostly.  IT  security  rarely  requires  wrestling  anyone 


Of  course,  it’s  one  thing  to  transfer  responsibility  for 
information  security  outside  IT,  but  if  accountability 
doesn’t  move  with  if,  the  CIO  will  be  in  big  trouble. 
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Siemens  Canada  CIO  Harald  Hoefler  (left) 
says  that  because  the  CSO,  John  Pomeroy 
(right),  reports  to  the  CFO  and  not  to  him, 
the  security  function  is  independent  and 
therefore  stronger. 


to  the  ground,  but  the  mind  of  a  malicious  hacker  isn’t  that  much 
different  from  that  of  a  more  physically  oriented  bad  guy,  argue 
security  experts.  So  why  do  companies  automatically  assume 
that  IT  people  can  think  like  criminals?  “Every  information  secu¬ 
rity  policy  I’ve  ever  seen  is  a  joke  because  they  are  written  by  peo¬ 
ple  who  can  be  trusted,”  says  Spernow,  who  has  worked  in 
corporate  security  for  Fidelity  Investments.  “We  have  these  exer¬ 
cises  we  do  with  IT  people  to  try  to  show  them  that  their  intuitive 
response  is  to  trust  people.  I  wouldn’t  hire  anyone  for  a  security 
position  unless  they  were  really  paranoid.” 

IT  people  also  don’t  have  much  experience  at  developing  poli¬ 
cies  and  procedures  for  handling  security  issues  beyond  the  tech¬ 
nical  issues,  says  Anne  Rogers,  director  of  information  safeguards 
for  Waste  Management.  According  to  Rogers,  responsibility  for 
security  polices  and  procedures  across  the  company  has  moved 


from  IT  to  Waste  Management’s  corporate  secu¬ 
rity  function,  while  responsibility  for  selecting 
technology  platforms  and  implementation 
remains  with  IT  (a  security  management  struc¬ 
ture  that  former  CIO  Smith  disagrees  with). 
“We’re  looking  at  security  policies  and  proce¬ 
dures  above  and  beyond  IT  and  how  those  sys¬ 
tems  affect  other  areas  in  the  company,”  she 
says.  “There  are  skills  and  background  for  doing 
this  that  security  people  have  and  most  IT  peo¬ 
ple  don’t.”  For  his  part,  Smith  says  IT  retains 
responsibility  for  security  policies  and  proce¬ 
dures  that  affect  IT  systems.  It’s  an  example  of 
the  struggle  over  security  that  is  beginning  to 
occur  in  many  companies. 

USE  INDEPENDENT  AUDITS 

Mary  Finlay,  deputy  CIO  of  Partners  Health- 
Care  System,  has  information  security  report¬ 
ing  to  her.  She  acknowledges  the  conflict  of 
interest.  For  health-care  companies  like  hers, 
she  says,  the  conflict  is  swept  away  by  external 
regulations  like  the  Health  Insurance  Portabil¬ 
ity  and  Accountability  Act  (HIPAA)  and  audit¬ 
ing  bodies  that  have  strict  terms  for 
compliance.  “There  are  three  arms  to  HIPAA, 
and  one  of  them  is  all  about  security,”  Finlay 
says.  She  says  Partners  also  has  internal  and 
external  auditing  groups  and  an  internal 
compliance  group  that  monitor  information 
security  issues.  That’s  a  lot  of  checking  and 
balancing.  For  companies  that  don’t  have  that 
kind  of  external  scrutiny  and  regulation,  a 
separate  information  security  function  may  be 
their  only  independent  voice.  “I  do  agree  that 
you  need  the  checks  and  balances  in  place  somehow,”  says  Finlay. 
“I  like  that  there  is  this  separate  part  of  the  organization  that  is 
keeping  us  on  our  toes.  ” 

Rod  Hamilton,  CIO  of  Hygeia,  a  health-care  provider  net¬ 
work,  says  the  size  of  his  company  and  his  budget  doesn’t  warrant 
having  a  separate  information  security  function.  He  was  able  to 
bring  in  a  person  who  spends  half  his  time  on  security  tasks  by 
devoting  the  rest  of  the  time  to  database  analysis.  HIPAA  defines 
the  more  strategic,  high-level  thinking  about  security  that  this 
staffer  does  not  have  the  time  for.  “HIPAA  is  a  godsend  in  a  way 
because  it  gives  us  a  clear  definition  of  what  we  should  be  doing 
and  gives  us  the  opportunity  to  bring  someone  else  in  to  say 
whether  we  are  meeting  the  requirements,”  says  Hamilton. 

But  are  external  regulations  or  audits  really  dependable  alter¬ 
natives  to  an  independent,  internal  CSO?  Capital  IQ’s  Murphy 
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total  support. 


WE'LL  MANAGE  YOUR  MISSION-CRITICAL  APPLICATIONS 
SO  YOU  CAN  FOCUS  ON  MANAGING  YOUR  BUSINESS 


Our  proactive  approach  to  managed  services  includes  capacity  planning, 
performance  analysis  and  application  deployment  services,  providing  you 
with  the  tools  you  need  to  understand  how  your  application  is  performing, 
leverage  new  technologies  and  plan  for  the  future.  Total  production  support 
for  your  application  code  frees  your  teams  to  concentrate  on  strategic 
initiatives.  Maximize  the  return  on  your  IT  investment  with  Highly 
Managed  Hosting  from  Data  Return. 


// 


DATA  RETURN 

highly  managed  hosting  www.  da  ta  ret  urn.  com 
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800.767.1514 
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Who  Is  the  CSO? 


Ambassador  Sells  security  to  the  organization  and  creates  urgency 
Negotiator  Gets  budget  resources  from  all  functions  in  the  company 
Change  agent  Helps  create  and  sell  plan  for  building  better  security 
Troubleshooter  Fixes  unanticipated  problems 

Enforcer  Deals  with  people  who  will  insist  on  being  part  of  problem 
ratherthan  the  solution 

SOURCE:  Bill  Spernow,  security  consultant 


doesn’t  think  so.  “Sarbanes-Oxley  isn’t  going  to  help  you  make 
a  decision  when  a  powerful  executive  comes  to  you  and  says  we 
can  get  important  new  functionality  that  a  client  is  demanding 
up  and  running  tomorrow  if  you  install  this  untested  software 
patch  right  now,”  he  says.  Capital  IQ’s  Pfeil  agrees.  “By  using 
regulations  or  auditors,  all  you’re  doing  is  shifting  accountabil¬ 
ity,”  he  adds.  “But  it  will  come  back  full  circle  no  matter  what 
you  do.  The  ones  who  have  to  implement  the  day-to-day  secu¬ 
rity  operations  are  still  going  to  be  on  the  hook.  If  you  centralize 
the  responsibilities  for  security  and  make  one  person  responsi¬ 
ble,  then  you’ve  got  one  neck  to  choke.” 

MAKE  A  STRONG  SECURITY  POLICY 

If  it’s  not  possible  to  move  information  security  out  of  IT,  then  an 
ironclad  security  policy  should  ensure  that  even  if  the  person  in 
charge  of  security  is  IT-based,  he  at  least  has  the  ability  to  report 
to  someone  senior  to  the  CIO,  say  security  advocates.  “If  nothing 
else,  the  CSO  must  have  real  access  to  the  other  C-level  people,” 
says  George  Campbell,  a  security  consultant  and  former  CSO  at 
Fidelity  Investments.  “As  long  as  the  CEO  and  board  back  a 
strong  policy  around  corporate  protection,  that’s  an  internal  legal 
system  that  the  CSO  can  use  to  manage  the  function.” 

But  Campbell  and  others  stress  that  unless  the  policy  is  clear 
and  detailed — for  example,  all  breaches  must  be  reported  imme¬ 
diately  to  the  COO  and  immediately  recorded  in  a  report — it 
won’t  be  much  of  a  tool.  “Unless  it’s  grounded  in  a  strong  policy 
infrastructure  that  gives  good  guidance  to  employees  and  func¬ 
tions  in  the  organization  on 


Try  the  Tool 


Whether  you’re  handing  over  or  hanging  on  to 
responsibility  for  security,  you  need  to  know  if 
your  practices  are  repeatable,  documented, 
and  regularly  reviewed  and  updated.  CIO's  sis¬ 
ter  publication  CSO  and  the  Software  Engineer¬ 
ing  Institute's  CERT  Coordination  Center 
together  created  the  SECURITY  CAPABILITY 
ASSESSMENT  TOOL,  which  lets  security 
professionals  assess  their  current  security 
practices.  Find  it  at  www.cio.com/printlinks. 

cio.com 


the  how-tos  of  corporate 
protection,  it  won’t  happen 
because  people  won’t  know 
what  to  do,”  says  Camp¬ 
bell.  CIOs  should  try  to  get 
advice  from  companies  that 
are  bound  by  law  to  secure 
and  protect,  like  health¬ 
care  and  financial  services 
companies.  “You  can’t  find 


a  financial  services  company  that  isn’t  con¬ 
cerned  about  how  it  protects  customer  infor¬ 
mation  or  continuity,  and  that  is  founded  on  a 
good  policy,”  he  says. 

And  the  conflict  of  interest  that  lies  at  the 
heart  of  the  CSO-to-CIO  reporting  relation¬ 
ship  can  erode  the  best  policy,  says  Siemens’ 
Pomeroy.  “It  has  to  be  like  an  independent 
internal  auditor  function  within  IT  if  it’s  going 
to  work,”  he  says.  “An  organization  can  think 
it  has  a  good  information  security  review 
process,  but  because  the  CIO  has  the  final  say, 
you’re  going  to  have  problems  potentially.” 

SECURITY  IS  CONVERGING 

There  is  a  small  though  growing  trend  of  IT  security  moving  under 
the  corporate  security  umbrella  so  that  security  decisions  all  come 
out  of  one  place.  But  experts  we  spoke  to  said  there  is  no  formula 
for  making  the  decision.  It  depends  on  factors  like  culture,  gover¬ 
nance  structure,  size  (and  size  of  customer  base),  sensitivity  of  cor¬ 
porate  data  and  demands  of  customers.  Companies  that  are  feeling 
increasing  pressure  in  any  of  these  areas  should  at  least  consider 
whether  information  security  and  corporate  security  should  be 
consolidated  into  a  single  group. 

The  strongest  argument  for  keeping  information  security 
within  IT  is  purely  pragmatic.  Much  of  information  security  has 
to  do  with  hard-core  IT  issues,  and  non-IT  people  don’t  under¬ 
stand  how  complex  it  can  be.  People  from  a  pure  security  back¬ 
ground  can  become  so  fixated  on  security  that  they  ignore  the 
need  to  make  systems  flexible  and  usable,  says  Finlay.  “There  are 
times  when  I’ve  seen  security  people  advocating  something  that 
makes  the  system  so  hard  to  use  that  people  wouldn’t  use  it.  The 
job  of  CIO  is  to  find  the  right  balance.”  To  which  CalSTRS’s 
Thomas  responds,  “That’s  why  it’s  important  for  us  to  have  a 
close  working  relationship  with  IT  and  work  together  as  a  team.” 

But  regardless  of  where  the  CSO  reports,  he  cannot  be  a  shrink¬ 
ing  violet.  CSOs  need  an  independent  voice  and  the  ability  to  pro¬ 
mote  the  position  and  the  need  for  security  inside  the  company 
(see  “Who  Is  the  CSO?”  this  page).  “If  CSOs  can  clearly  com¬ 
municate  their  role  and  the  role  of  security  in  the  organization,  it 
doesn’t  matter  where  they  report  to,”  saysj.  R.  Biggs,  managing 
director  at  Network  Security  Consulting  and  a  former  CSO  for 
a  financial  services  company.  “You  have  to  be  able  to  communi¬ 
cate  and  justify  your  role  and  responsibilities  and  make  sure  every¬ 
one  understands  that  security  is  the  responsibility  of  everyone  in 
the  organization.” 

That  sure  sounds  like  independence  to  us.  0EI 

Send  your  stories  on  security  challenges  to  Executive  Editor  Christopher 
Koch  at  ckoch@cio.com. 
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AT&T  WIRELESS  SELF 


The  story  of  a  botched  CRM  upgrade  that  cost  the 
telco  thousands  of  new  customers  and  an  estimated 
$100  million  in  lost  revenue.  Hard  lessons  learned. 

BY  CHRISTOPHER  KOCH 


Jack  Lee  marked  Nov.  24, 2003,  on  his  calendar  because  that  was  the  day  he  would  finally 

be  able  to  change  his  cell  phone  carrier  without  losing  his  phone  number — thanks  to  a  Federal  Com¬ 
munications  Commission  ruling.  But  Lee,  president  of  Tangara  Technologies,  a  company  that  devel¬ 
ops  software  for  forms,  decided  to  wait  a  day  before  switching  to  AT &T  Wireless  to  let  the  chaos  of 
“number  porting”  die  down  a  little.  Little  did  he  know  that  the  chaos  was  just  beginning. 

Lee  ordered  his  new  phone  on  Nov.  25.  When  he  went  to  the  AT&T  Wireless  website  to  check  the 

status  of  his  order  a  day  later,  he  was  greeted  with  a  mes¬ 
sage:  “We  could  not  find  a  porting  request  for  this  num¬ 
ber  in  the  system.  Please  contact  Customer  Care.  ”  It  was 
the  beginning  of  a  two-month  odyssey  in  which  Lee  esti¬ 
mates  he  made  15  to  20  calls  to  AT&T  Wireless,  sent 
nearly  as  many  e-mails  and  spent  60  hours  on  the  phone 
dealing  with  customer  service  representatives  or  waiting 
on  hold — with  the  line  often  going  dead  when  AT&T 
Wireless’s  customer  service  lines  became  overloaded. 


Reader  ROI 

►  How  an  upgrade  meant  to  improve 
customer  service  crippled  it  instead 

►  Why  having  an  alternative  plan  is 
essential  when  you're  up  against  a 
specific  deadline 

►  Why  outsourcing  in  the  middle  of  an 
implementation  can  be  disastrous 
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After  being  routed  all  over  the  company,  Lee  finally  discovered 
what  was  going  on.  A  major  CRM  system  had  crashed  during  an 
upgrade,  and  customer  service  representatives  could  not  set  up  or 
access  new  accounts.  The  system  breakdowns,  which  continued 
through  February  2004,  swamped  other  AT&T  systems,  grid- 
locked  customer  service  phone  banks  and  sent  furious  customers 
scurrying  to  other  providers. 

The  breakdown  couldn’t  have  come  at  a  worse  time  for  AT &T 
Wireless.  It  deprived  the  telco  of  thousands  of  potential  new  cus¬ 
tomers  and  cost  the  company  an  estimated  $100  million  in  lost 
revenue.  But  that  wasn’t  all.  The  failure  so  damaged  AT &T  Wire¬ 
less’s  reputation  that  many  analysts  believe  it  hastened  its  sale  to 
Cingular  in  February  for  $41  billion,  or  $15  per  share,  which  was 
just  under  half  the  value  of  AT&T  Wireless’s  shares  when  it  went 
public  in  April  2000.  While  an  AT&T  Wireless  spokesman  says 
the  company  would  have  been  sold  regardless  of  the  fiasco  because 
“it  was  the  right  thing  to  do,”  the  crash  and  resulting  confusion 
could  not  have  helped  AT&T  cut  a  good  deal.  “The  system  prob¬ 
lems  made  AT&T  look  like  a  wounded  provider,  and  the  sharks 
smelled  blood  and  circled,”  says  Roger  Entner,  a  wireless  and 
mobile  services  analyst  at  The  Yankee  Group,  a  research  company. 

AT&T  Wireless’s  mistakes  offer  valuable  lessons  for  CIOs.  For 
one,  it’s  unwise  to  freight  major  system  upgrades  with  external 
complications.  AT&T  Wireless’s  CRM  upgrade  was  hamstrung 
from  almost  the  very  beginning  by  rumors  of  outsourcing  deals 
and  future  layoffs.  These  rumors  generated  pervasive  morale  prob¬ 
lems  that  hurt  the  productivity  of  project  staff. 

Second,  it  should  be  understood  that  complex  projects  require 
flexible  deadlines.  AT&T  Wireless  undertook  a  difficult  upgrade 
that  affected  roughly  15  systems  just  before  it  was  faced  with  an 
immovable  deadline — the  federally  mandated  Nov.  24  number 
portability  date. 

Finally,  it  always  pays  to  have  a  plan  B.  Without  one,  AT&T 
Wireless  was  forced  to  move  forward  even  as  it  became  apparent 
that  its  upgrade  would  not  be  completed  in  time. 


PLAYING  CATCH-UP  WITH  THE 
COMPETITION 

When  AT&T  Wireless  began  its  Siebel  CRM  system 
upgrade  in  2003,  it  was  a  company  that  had  slipped 
from  unquestioned  market  leader  to  middle  of  the  pack. 
Its  overall  market  share  had  slid  from  an  industry-leading  25  per¬ 
cent  at  the  end  of  2001  to  17  percent  in  2003,  third  behind  Veri¬ 
zon  and  Cingular. 

Worse,  AT &T  Wireless  was  playing  catch-up  on  its  most  impor¬ 
tant  technology  asset,  its  phone  network.  One  of  the  older  wire¬ 
less  companies,  AT &T  Wireless  made  an  early  bet  on  a  technology 
called  TDMA  that  could  not  handle  data  transfer  over  cell 
phones — the  next  big  thing  for  business  customers.  Even  before 


AT&T  Wireless  vs.  Verizon 
Wireless:  Losing  Ground 

Between  2001  and  2003,  AT&T 
Wireless  lost  significant  ground  to 
Verizon  Wireless  (now  the  industry 
leader).  That's  what  its  CRM  upgrade 
was  intended  to  fix.  It  didn’t. 


MARKET  SHARE 


In  2001,  AT&T  Wireless  was  the  market  leader;  by 
third  quarter  of  2003,  it  had  fallen  to  third  place,  and 
Verizon  had  climbed  from  second  to  first. 


SUBSCRIBER  GROWTH 


In  2001,  AT&T  Wireless  had  the  fourth  highest  rate  of 
subscriber  growth  in  the  industry;  by  third  quarter  of 
2003,  it  had  fallen  to  sixth  and  last,  while  Verizon  had 
climbed  from  fifth  place  to  third. 


COST  PER  NEW  SUBSCRIBER 
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In  2001,  AT&T  Wireless  spent  more  money  to  attract 
new  subscribers  than  all  but  two  of  its  competitors, 
and  in  2003,  it  was  still  spending  more  than  Verizon, 
which  continued  to  spend  less  than  any  competitor. 


MONTHLY  CHURN  RATE 


In  2001,  both  AT&T  Wireless  and  Verizon  Wireless 
had  the  same  rate  of  customer  churn.  By  2003,  Veri¬ 
zon's  churn  rate  had  dropped  significantly,  while 
AT&T  Wireless's  had  not  budged. 


Source:  UBS 
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How  you'll  feel  without 
a  Linux  strategy  from  Novell 


We've  built  our  reputation  on  keeping  you  covered.  With  the  acquisition  of  SUSE®  LINUX,  Novell®  now  delivers  the  most  secure  end-to-end  open  source  strategies  available.  We'll  implement 
and  support  Linux  from  desktop  to  server,  integrating  it  with  your  current  environment,  across  multiple  platforms.  As  you  migrate  to  Linux  we'll  train  and  certify  your  IT  staff  to  deploy 
Linux-based  solutions.  You'll  get  award-winning  technical  support,  customized  for  your  business,  24/7/365  worldwide.  And  the  Novell  Linux  indemnification  program  will  help  prevent 
exposure.  We'll  even  make  sure  your  open  source  strategy  actually  meets  your  number-one  business  objective  -  making  money.  To  implement  a  Linux  strategy  unsurpassed  for  support, 
flexibility  and  cost-effectiveness,  call  1-800-215-2600  or  visit  www.novell.com/linux  ©we  speak  your  language. 


A  NOVELL  COMPANY 


©2004  Novell  is  a  registered  trademark  of  Novell,  Inc.  in  the  United  States  and  other  countries.  SUSE  is  a  registered  trademark  of  SUSE  AC,  a  Novell  company. 
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AT&T  Wireless  was  spun  out  from  its  parent  AT&T  in  2001,  it 
had  begun  a  furious  buildout  of  an  expensive  new  network — global 
system  for  mobile  communications,  or  GSM — that  could  not  only 
handle  data  but  had  the  added  advantage  of  global  compatibility 
with  overseas  providers.  Only  one  other  major  carrier,  Cingular, 
was  saddled  with  the  challenge  of  building  out  a  new  GSM  net¬ 
work  while  still  servicing  the  old  one.  The  other  carriers  had  all 
chosen  network  technologies  that  could  handle  data  transfers. 

GSM  was  a  great  opportunity  for  AT&T  Wireless,  but  it  was 
also  a  huge  CRM  challenge.  The  company  had  to  convince  its  old 
customers  to  move  off  TDMA,  which  worked  as  well  as  most  other 
carriers’  networks  for  voice  calls,  and  onto  GSM,  which  had  poorer 
voice  quality,  according  to  Morgan  Stanley.  It  also  had  to  convince 
new  customers  that  GSM  was  the  wave  of  the  future,  that  they 
would  soon  be  shipping  data  over  their  phones  instead  of  their  lap¬ 
tops.  But  customers  didn’t  buy  the  pitch.  By 2003,  AT &T  Wireless’s 
percentage  of  customers  on  GSM  was  hovering  at  15  percent, 
according  to  analysts,  while  Cingular  had  35  percent  of  its  cus¬ 
tomers  moved  over  (thanks,  in  part,  to  its  acquisition  of  a  cellular 
provider  with  an  existing  GSM  network).  And  things  weren’t 
improving.  In  the  third  quarter  of  2003,  less  than  half  of  AT&T 
Wireless’s  new  customers  were  choosing  GSM,  while  Cingular  was 
signing  up  75  percent,  according  to  Morgan  Stanley. 

Everyone  at  AT&T  Wireless  agreed  that  the  company 
would  keep  its  existing  customers  and  add  more  new  ones 
if  its  customer  representatives  could  handle  more  calls  and 
get  customers  up  and  running  faster.  Customer  service  rep¬ 
resentatives  needed  about  20  minutes,  on  average,  to  work 
through  five  or  six  screens  that  fetched  information  from 
about  15  legacy  systems,  say  former  employees.  Slow  access 
to  customer  information  records  was  just  one  of  the  reasons 
why  AT&T  Wireless  possessed  the  second-highest  cost  per 
subscriber  (behind  Sprint  PCS)  of  the  top  six  national  carri¬ 
ers  in  2003,  according  to  financial  services  company  UBS. 


Five  Lessons  from  AT&T 
Wireless’s  Project  Failure 

It  did  a  lot  wrong.  Here’s  what  you 
can  do  right. 

Have  a  plan  B.  AT&T  Wireless’s  Siebel  system  upgrade 
involved  vastly  complex  systems  integration  and  testing 
that  pushed  up  against,  and  crashed  through,  an  immov¬ 
able  deadline:  wireless  number  portability.  An  alternate 
means  for  accessing  customer  data  or  a  plan  to  be  able 
to  roll  back  to  the  earlier,  more  stable  version,  if  neces¬ 
sary,  would  have  saved  the  company  millions. 

Keep  testing  requirements  strong— even  when 
projects  fall  behind.  When  projects  run  late,  testing 
always  suffers,  with  often  disastrous  results. 

Reduce  integration  wherever  possible.  When  all  of  AT&T 

Wireless’s  major  competitors  chose  another  company 
for  wireless  number  porting,  AT&T  Wireless  should  have 
rethought  its  choice  of  a  competing  vendor,  which  meant 
extra  layers  of  integration  that  ultimately  failed. 

Postpone  layoffs  and  offshore  outsourcing  until  a  vital 
systems  project  is  completed.  Morale  and  productivity 
among  the  AT&T  Wireless  IT  staff  were  shattered  by 
rumors  of  offshore  outsourcing  and  layoffs  that  swirled 
around  the  project  but  were  left  mostly  unaddressed  by 
IT  leaders. 

Keep  the  communication  lines  open  and  clear.  If  layoffs 
or  outsourcing  is  unavoidable  during  a  project, 
communicate  that  news  clearly  and  get  the  changes  over 
with  as  early  in  the  project  as  possible.  -C.K. 


WHY  AT&T  NEEDED  TO  UPGRADE 

T&T  Wireless  installed  Siebel’s  CRM  system  in  2001  to 
be  the  front  end  of  its  customer  service  process.  The  back 
end,  however  was  a  complex  mishmash  of  systems,  say  for¬ 
mer  employees.  Telco  billing  systems,  for  example,  were  stuffed 
full  of  different  rate  plans  and  arcane  metering  processes.  Systems 
that  tracked  calls  and  set  up  new  phone  numbers  (provisioning) 
communicated  with  hundreds  of  thousands  of  different  telephone 
switches  around  the  country  and  the  world.  To  work  for  AT&T 
Wireless,  Siebel’s  version  6  had  to  be  highly  customized.  Though 
the  software  came  with  integration  tools,  consultants  usually 
resorted  to  writing  point-to-point  scripts  to  hook  the  systems 
together.  Policing  the  overall  integration  in  a  scenario  like  this  is  dif¬ 
ficult  at  best.  Indeed,  a  former  AT&T  Wireless  employee  who 


worked  on  the  project  recalls  the  test  system  crashing  and  remain¬ 
ing  down  for  six  weeks  during  the  summer  of 2002  when  AT &T 
Wireless  began  preparing  Siebel  version  6  to  deal  with  number 
portability.  And  when  Siebel  6  was  finally  up  and  running,  it  still 
couldn’t  handle  all  the  information  that  customer  service  repre¬ 
sentatives  needed. 

The  next  release  of  Siebel,  version  7,  was  much  more  powerful. 
Siebel  developed  an  industry-specific  version  of  the  new  software 
that  had  many  more  features  and  could  capture  more  telco-specific 
information.  And  new  Web  capabilities  meant  that  AT &T  Wireless 
could  potentially  reduce  the  number  of  customer  service  screens  to 
one  by  building  a  Web  portal  that  put  all  the  different  systems  and 
information  sources  together  in  one  place.  “That  was  the  point  of 
the  upgrade,”  says  a  former  employee.  “They  wanted  to  get  every- 
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thing  on  one  screen  so  they  could  sign  up  customers  faster.” 

Marc  Siegel,  a  spokesman  for  AT&T  Wireless,  agrees: “As 
we  needed  to  handle  more  transactions,  more  customers,  we 
needed  a  more  robust  system.  So  we  upgraded.  [The  up¬ 
grade]  was  going  to  make  it  easier  for  our  representatives  to 
get  access  to  information  and  give  them  a  fuller  array  of 
information  on  the  customer.” 

In  the  spring  of 2003,  the  company  decided  to  upgrade  to  version 
7.5  for  the  roughly  3  million  customers  on  the  GSM  and  general 
packet  radio  service  (the  data  portion  of  the  new  network) .  TDMA 
customers  would  continue  to  be  serviced  through  AT &T  Wireless’s 
legacy  Axys  CRM  system  until  they  could  be  moved  over  to  GSM 
and  the  new  Siebel  system.  The  project  was  called  Odyssey. 

THE  UPGRADE  BEGINS,  BADLY 

Though  the  upgrade  promised  gains  in  speed  and  simplicity, 
getting  there  was  neither  speedy  nor  simple.  AT&T  Wire¬ 
less’s  IT  staff  had  to  rip  apart  old  links  from  the  different  legacy 
systems  to  the  client/server-based  Siebel  6  system  and  rewrite  them 
to  work  over  the  Web.  The  back-end  systems-integration  work  was 
so  complex  that  it  wasn’t  unusual  to  see  teams  of  20  or  more  peo¬ 
ple  assigned  to  write  connections  for  a  single  system,  says  a  former 
employee.  Coordination  between  the  teams — the  responsibility  of 
the  lead  integrator  on  the  project,  Deloitte  and  Touche — quickly 
got  out  of  hand.  (Deloitte  and  Touche  did  not  respond  to  repeated 
requests  for  an  interview.) 

“Everything  was  siloed  among  the  different  groups,  and  we  all 
worked  independently  of  each  other,”  says  a  project  team  mem¬ 
ber.  Teams  would  work  on  a  revision  to  their  piece  of  Odyssey,  for 
example,  only  to  find  that  when  they  finished  testing,  code  had 
changed  elsewhere  in  the  system,  rendering  the  testing  meaning¬ 
less.  “In  other  projects  I’ve  worked  on,  the  project  managers  would 
freeze  code  while  the  teams  did  revisions  to  their  pieces  so  you 
could  test  everything  against  the  same  code  base,”  he  says.  “Ididn’t 
hear  of  that  happening  on  this  project.” 

Meanwhile,  rumors  of  layoffs  and  offshore  outsourcing  began 
swirling  around  Odyssey.  “[The  rumors]  slowed  things  down,” 
says  a  former  employee.  “When  stuff  like  that  happens,  people 
start  looking  for  other  work.  I  know  I  was 
looking  for  other  work  when  I  should 
have  been  testing.” 

MEET  THE  NEW  BOSS 

n  April  10, 2003,  Mike  Benson,  a 
15-year  AT&T  veteran,  sent  a 
memo  to  employees  announcing 
that  he  was  leaving  after  three  years  as 
CIO.  AT&T  Wireless’s  Siegel  says  the  48- 


year-old  Benson  “decided  to  retire.”  Christopher  Corrado,  the 
head  of  the  security  solutions  practice  for  Wipro,  an  Indian  off¬ 
shore  outsourcing  company,  was  named  executive  vice  president 
and  CIO.  Before  joining  AT&T  Wireless,  Corrado  had  been  CTO 
at  two  divisions  of  Merrill  Lynch,  where  he  presided  over  the  off¬ 
shore  outsourcing  of  portions  of  Merrill  Lynch’s  IT.  Employees 
speculated  that  it  was  just  a  matter  of  time  before  offshoring  began 
at  AT&T  Wireless. 

“Corrado  was  the  hatchet  man — everyone  knew  it,”  says  a  for¬ 
mer  employee.  “We’d  see  our  people  going  into  these  long  meetings 
with  people  from  Indian  companies.  We’d  see  whiteboards  that 
had  questions  like,  ‘What  opportunity  do  we  have  to  offshore/out¬ 
source?”’ 

Former  employees  say  morale  wasn’t  helped  by  Corrado’s  first 
presentation  to  the  IT  group,  in  which  they  say  he  proclaimed, 
“  Come  in  every  day  and  expect  to  be  fired.  ”  Intended  to  inspire  the 
troops  to  greater  effort,  the  talk  backfired,  says  another  former 
employee.  “We  all  came  away  saying,  ‘Who  is  this  arrogant  jerk?”’ 
Corrado  could  not  be  reached  for  comment. 

THE  DEADLINE  LOOMS 

s  November  approached,  AT&T  Wireless  was  one  of  the 
last  industry  holdouts  opposing  the  Federal  Communica¬ 
tions  Commission’s  new  rule  on  number  portability,  along 
with  Cingular  and  Alltel.  The  industry  had  succeeded  in  delaying 
the  change  since  1998  on  legal  technicalities,  and  AT&T  Wire¬ 
less  was  counting  on  another  postponement,  say  industry  sources. 
But  on  Halloween,  the  U.S.  Court  of  Appeals  for  the  District  of 
Columbia  Circuit  rejected  the  appeal  to  move  back  the  FCC’s  Nov. 
24  deadline.  An  AT&T  Wireless  spokesman  told  Bloomberg 
News  that  the  company  was  ready  for  porting. 

It  wasn’t. 

Things  were  going  so  badly  with  the  Siebel  CRM  upgrade  that 
there  was  talk  on  the  project  of  trying  to  roll  back  to  the  old  Siebel 
6  system  before  the  porting  date.  “Two  weeks  before  launch  there 
was  rollback  talk,”  a  former  employee  says.  But  project  managers 
hadn’t  preserved  enough  of  the  old  system  to  make  it  feasible. 
There  was  no  plan  B.  Project  members  estimated  that  the  team 
needed  two  or  three  more  months  of  bug 
fixing  and  testing  to  get  the  system  running 
reliably. 

And  the  Siebel  system  wasn’t  the  only 
thing  AT &T  Wireless  needed  to  get  work¬ 
ing  before  the  deadline.  Wireless  number 
porting  required  new  systems  that  had  to 
be  integrated  with  the  different  carriers’ 
CRM  systems.  Five  of  the  six  top  pro¬ 
viders  outsourced  the  administration  of 
the  number  changes  to  TSI  Communica- 
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Too  bad  AT&T  Wireless  couldn't  get  it  right. 
Even  the  $3  trillion  worldwide  construction 
industry  is  adopting  IT  to  manage  its 
immensely  intricate  projects.  And  a  small 
publisher  in  Salt  Lake  City  could  have 
taught  the  erstwhile  wireless  pro  about 
project  prioritization.  We  covered  both 
recently:  CURES  FOR  COMPLEXITY  and 
FIRST  THINGS  FIRST,  respectively.  Find 
the  links  at  www.cio.com/printlinks. 
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tions  and  used  software  built  by  Telcordia.  But  in  June  2002 
(before  the  other  carriers  had  announced  they  were  going  with 
TSI),  AT&T  Wireless  chose  its  longtime  software  and  admin¬ 
istration  provider,  NeuStar.  Ultimately,  this  would  create  serious 
interoperability  problems  for  AT&T  Wireless. 

AT&T  Wireless  defends  its  decision  by  saying  that  NeuStar 
was  the  most  experienced  provider  in  the  market,  having  worked 
on  landline  portability  in  the  early  ’80s.  It  also  says  NeuStar’s  soft¬ 
ware  offering  was  more  complete  than  TSI’s  at  the  time  AT&T 
made  its  decision. 


NO  TREAT,  JUST  TRICK 

On  Halloween  evening,  the  project  team  tried  to  bring  up  the 
new  Siebel  system  for  the  first  time.  It  crashed.  “It  went 
down  and  stayed  down,”  says  a  former  employee.  “They 
couldn’t  get  it  working  again.”  Project  staffers  were  brought  in  to 
work  on  the  system  for  three  straight  days  to  try  to  rescue  it,  with  no 


report  prepared  by  Tata  Consulting  Services  of  India  outlining 
plans  for  offshoring  pieces  of  AT &T  Wireless’s  IT  infrastructure. 
The  report,  obtained  by  CIO,  also  lays  out  plans  for  offshoring 
a  portion  of  the  support  and  maintenance  for  the  new  Siebel  sys¬ 
tem.  “You  had  to  wonder  why  you  were  working  so  hard  if  the 
whole  thing  was  going  to  go  away  anyway,”  says  a  former  proj¬ 
ect  employee. 

On  Nov.  19,  The  Wall  Street  Journal  ran  a  story  on  planned 
layoffs  and  outsourcing  at  AT&T  Wireless,  and  CIO  Corrado 
responded  in  a  memo  to  the  staff:  “We  are  in  the  awkward  posi¬ 
tion  of  having  reports  in  the  press  about  a  contract  with  HP  before 
we  have  communicated  with  the  employees  who  will  be  affected. 
We  have  just  today  signed  a  letter  of  intent  with  HP  to  deliver  the 
services  provided  by  the  following  teams:  Desktop  Services;  Retail 
Field  Services;  Business  Office  WAN/Telecom;  MSI  Packaging; 
Service  Desk — password  reset  and  desktop  calls.”  But  as  for  big¬ 
ger  questions,  namely  that  support  and  maintenance  for  the  Siebel 
system  would  be  outsourced  to  offshore  provider  Wipro  and  Tata, 


CIO  Christopher  Corrado  never  directly  addressed 
rumors  that  AT&T  Wireless  planned  to  outsource  much 
of  the  support  and  maintenance  for  its  CRM  system. 


luck,  say  former  employees.  The  system  was  unstable. 

Though  observers  could  not  trace  specific  causes  for  the  crash, 
a  few  factors  played  a  role.  As  the  go-live  date  neared,  former 
employees  say  that  Deloitte  and  Touche  proj  ect  managers  relaxed 
testing  requirements  for  various  pieces  of  the  system.  Rather  than 
freeze  the  code  for  the  system  once  problems  began,  teams  con¬ 
tinued  to  add  new  pieces  to  the  project  in  an  attempt  to  get  it  all 
working.  But  the  new  pieces  simply  added  more  errors  to  an 
already  bug-ridden  system,  which  complicated  the  process  of  find¬ 
ing  root  problems  and  fixing  them. 

“  [Integration  was]  far  more  technical  and  far  more  difficult  to 
test  in  advance  and  also  fix  problems  once  they  appeared,” 
acknowledged  Michael  Keith,  president  of  AT&T  Wireless 
Mobility  Operations,  in  a  conference  call  on  the  company’s  fourth 
quarter  results. 

Compounding  these  difficulties  was  the  hit  employee  morale 
had  taken  on  Nov.  1 6,  when  AT &T  Wireless  President  and  CEO 
John  Zeglis  confirmed  the  layoff  rumors.  Zeglis  told  analysts  in  a 
third  quarter  conference  call  that  the  company  would  lay  off  1 ,900 
workers.  He  did  not  say  where  the  cuts  would  come  or  when.  But 
IT  managers  started  telling  employees  that  layoffs  would  begin  in 
February  2004,  according  to  former  employees. 

Some  AT&T  Wireless  IT  employees  had  gotten  hold  of  a 


Corrado  did  not  address  the  rumors  directly.  Instead,  he  con¬ 
cluded:  “We  currently  outsource  work  throughout  the  company, 
including  work  within  both  Customer  Services  and  IT.  We  will 
continue  evaluating  the  best  mix  of  internal  and  external  resources 
as  we  work  to  achieve  best-in-class  margins.” 

In  fact,  AT&T  Wireless  was  planning  to  move  overseas  more 
than  3,000  positions  in  its  computer  operations  and  customer 
service. 

THE  SECOND  CRASH 

he  Odyssey  team  was  still  struggling  to  get  the  Siebel  system 
up  and  keep  it  up  when,  on  Nov.  24,  customers  began  trying 
to  port  their  numbers  between  carriers.  That’s  when  the  soft¬ 
ware  for  handling  number  portability  crashed. 

TSI  and  NeuStar  had  arrived  at  “differing  interpretations”  of 
the  industry’s  data  standard  for  exchanging  and  verifying  porting 
requests,  known  as  Wireless  Intercarrier  Communications  Inter¬ 
face  Specifications  ( WICIS) .  The  Yankee  Group’s  Entner  says  that 
TSI  modified  its  version  of  the  WICIS  standard  without  telling 
NeuStar.  “They  made  changes  in  fields  and  reporting  that  didn’t 
impact  all  their  five  customers  but  no  longer  made  it  possible  to 
communicate  with  [NeuStar],”  says  Entner.  TSI’s  Michael  O’Brien, 
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vice  president  of  marketing,  denies  that  changes  were  made  with¬ 
out  telling  NeuStar  but  acknowledges  that  the  two  vendors  had 
different  interpretations  of  WICIS.  (NeuStar  declined  to  be  inter¬ 
viewed  for  this  story.)  AT&T  Wireless  says  that  TSI  crashes  prior 
to  the  deadline  prevented  NeuStar  from  being  able  to  test  the 
process  adequately,  and  on  Nov.  24,  the  electronic  flow  of  porting 
requests  between  NeuStar  and  TSI  broke  down  right  away. 

The  industry  had  estimated  that  automated  ports  would  require 
2.5  hours  to  complete,  so  the  porting  messages  were  programmed 
with  time  and  date  limits.  If  the  other  carrier’s  system  didn’t 
respond  within  the  allotted  time,  the  port  that  failed  was  supposed 
to  drop  into  an  electronic  bin  to  be  handled  manually. 

NeuStar’s  software  could  not  respond  to  TSI’s  systems  before 
time  ran  out.  And  the  error  messages  weren’t  all  getting  through 
either.  When  AT&T  Wireless’s  Porting  Administration  Group 
tried  to  track  and  resolve  errors  using  a  workflow  management 
tool,  it  crashed  or  froze.  That  meant  AT&T  Wireless  customer 
service  representatives  were  in  the  dark  when  their  phones  lit  up. 
Combined  with  their  continued  problems  accessing  Siebel,  there 


pretty  far  south.” 

For  independent  cell  phone  retailers,  which  account  for  about 
60  percent  of  new  sales  in  the  industry,  there  was  no  choice.  “The 
indirect  sellers  pushed  other  brands  when  they  heard  that  AT&T 
was  having  problems,”  says  Greg  Teets,  telecom  analyst  for  A.G. 
Edwards.  AT &T  Wireless  was  forced  to  bump  up  commissions  to 
independents  and  lower  prices  to  try  to  stem  the  tide.  It  didn’t 
work.  After  adding  229,000  customers  in  the  third  quarter  of 
2003,  fifth  out  of  the  top  six  providers,  AT&T  Wireless  added 
just  128,000  in  the  fourth  quarter,  last  among  the  top  providers 
and  less  than  one-tenth  the  number  of  industry  leader  Verizon, 
which  added  1.5  million  new  subscribers. 

By  January,  AT&T  Wireless  was  in  the  advanced  stages 
of  plans  to  move  overseas  more  than  3,000  positions  in  its 
computer  operations  and  customer  service,  according  to 
The  Wall  Street  Journal.  (It  backed  off  from  the  plan  only 
after  agreeing  to  be  purchased.)  Some  employees  became 
part  of  AT&T  Wireless’s  “buddy  program,”  in  which  con¬ 
sultants  from  Indian  outsourcing  companies  Tata 


While  employees  struggled  to  fix  glitches  in  the  CRM 
upgrade,  CEO  John  Zeglis  confirmed  the  layoff  rumors, 
saying  AT &T  Wireless  would  soon  lay  off 1,900  workers. 


was  little  they  could  do  to  help  their  customers.  In  that  first  week 
of  porting,  more  than  half  of  the  complaints  filed  with  the  FCC 
singled  out  AT&T  Wireless,  according  to  The  Associated  Press. 
The  FCC  sent  a  letter  to  AT&T  Wireless  on  Dec.  4,  asking  for  an 
explanation,  triggering  a  torrent  of  bad  publicity. 

“There  were  50,000  [AT&T]  customers  per  week  that  didn’t 
have  service  because  of  this,”  says  Phil  Cusick,  a  telecom  indus¬ 
try  analyst  with  Bear  Stearns.  And  many  of  them,  like  independ¬ 
ent  consultant  Ian  Drake,  didn’t  stick  around  for  a  fix.  After  three 
weeks  of  trying  to  track  his  newly  purchased  AT&T  Wireless 
phone,  Drake  gave  up  and  signed  on  with  Verizon. 

A  COMPANY  FIRE  SALE 

s  word  of  AT&T  Wireless’s  difficulties  spread,  customers 
began  deserting  at  a  rapid  clip.  The  problems  continued 
through  December  according  to  AT &T  Wireless  President 
and  CEO  Zeglis.  “It  took  most  of  December  to  expand  the  systems 
capacity  so  that  the  care  reps  could  have  as  much  access  as  they 
needed  in  order  to  handle  customer  calls  at  the  same  time  the  sales¬ 
people  were  processing  new  orders,”  he  said  in  a  conference  call 
with  analysts  on  Jan.  22.  “Frankly,  our  customer  service  went 


Consultancy  Services  and  Wipro  were  assigned  to  AT&T 
Wireless  employees  to  learn  their  jobs. 

In  February,  220  AT&T  Wireless  IT  employees  were  told 
that  they  would  be  released  from  the  company  in  March. 
According  to  one  of  the  terminated  employees,  another 
round  of  250  layoffs  is  planned  for  June  and  the  same  num¬ 
ber  for  September.  “It’s  tough,”  an  employee  said  in 
February.  The  Indian  workers  “basically  follow  people 
around  all  day  and  pepper  them  with  questions.”  Other 
former  employees  say  some  staffers  resisted  helping  the  con¬ 
sultants.  “People  would  make  project  decisions  when  the 
Indians  weren’t  around,”  a  former  employee  says. 

On  Feb.  17,  Cingular  announced  that  it  was  buying  AT&T 
Wireless. 

That  same  day,  Deborah  Sawyer’s  voice-mail  box  began 
filling  up  with  messages.  Sawyer,  a  partner  for  executive 
search  firm  Morgan  Howard  Worldwide,  says  she  received 
inquiries  from  12  different  AT&T  Wireless  IT  executives 
looking  to  move  on. 

But  for  their  company,  the  odyssey  was  over.  HP1 


Executive  Editor  Christopher  Koch  can  be  reached  at  ckoch@cio.com. 
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Management  Strategies 


BP 


For  five  years,  BP  CIO  John  Leggate  has  managed  people  and  IT 
systems  in  concert  with  his  CEO’s  acquisition-hungry  strategy. 
His  mantra:  Integrate  always,  outsource  often,  and  make  tech¬ 
nology  pay— or  don't  make  it  at  all.  BY  SUSANNAH  PATTON 


A  Gusher  of  Mergers 

In  August  1998,  with  the  energy  industry  reeling  from  a  sharp  drop  in  oil  prices, 
British  Petroleum’s  CEO  made  a  daring  move.  John  P.  Browne,  the  cigar-puffing, 
Cambridge-educated  chief  executive  took  over  Chicago-based  Amoco  in  a  deal 
worth  $52  billion,  turning  his  midsize  British  company  into  one  of  the  world’s  energy 
giants,  in  a  league  with  Royal  Dutch/Shell  and  number-one  Exxon  Mobil.  Browne 
promised  that  he  would  slash  $2  billion  a  year  from  expenses — and  that  half  a  bil¬ 
lion  would  come  from  IT,  where  he  saw  cost-cutting  opportunities  from  overlapping 
staffs  and  systems.  The  acquisition  set  off  a  wave  of  industry  consolidation  as  U.S. 
business  magazines  compared  Browne  to  General  Electric’s  then-CEO  Jack  Welch. 

Amoco  was  the  first  of  several  high-profile  deals  for  Browne,  who  had  taken  BP’s 
helm  in  1995  after  heading  its  exploration  unit.  He  had  watched  as  British  Petro¬ 
leum,  which  ranked  27th  in  the  Global  500  in  1996,  had  become  dependent  on 
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maturing  fields  in  Alaska  and  the  North  Sea. 
With  a  limited  world  supply  of  oil  and  gas 
reserves,  Browne  saw  little  alternative  to 
growing  BP  except  through  acquisition. 

So  the  M&A  action  began.  After  Amoco 
came  BP’s  $26.8  billion  purchase  of  U.S.- 
based  Atlantic  Richfield  in  1 999;  $4.7  billion 
to  snap  up  British  lubricant  company  Burmah 
Castrol  in  2000;  and  a  $4  billion  takeover  of 
Germany’s  Veba  Oel.  In  August  2003,  with 
BP  ranked  fifth  in  the  Global  500,  Browne 
invested  $8.1  billion  in  Russian  oil  giant  TNK, 
created  during  the  Soviet  Union’s  collapse. 

IT  has  long  been  central  to  Browne’s  think¬ 
ing — his  commitment  to  IT  outsourcing  is 
cited  in  a  business  school  case  study  and  he’s 
been  an  Intel  director  since  1 997.  But  the  idea 
that  IT  could  enable  BP’s  growth  appeared  to 
crystallize  during  this  entrepreneurial  surge. 
At  Oxford  University  in  200 1 ,  he  said:  “It  was 
only  really  two  or  three  years  ago  that  we 
started  to  see  IT  as  a  set  of  integrated  tech¬ 
nologies  with  a  real  business  potential.” 
Browne  added  that  he  sees  IT  “not  just  as  a 
service  function. ..but  as  an  activity  which 


cutting  costs  wherever  possible  and,  most  of 
all,  someone  as  daring  as  himself. 

Enter  John  Leggate,  fresh  from  a  year  as 
president  of  BP’s  Azerbaijan  operations,  where 
he  had  been  part  of  a  team  negotiating  a  multi- 
billion-dollar  pipeline  deal  across  the  Caucasus 
Mountains — a  project  that  inspired  the  James 
Bond  movie  The  World  Is  Not  Enough.  An 
engineer  by  training,  with  no  specific  IT  expe¬ 
rience,  the  ebullient  Scotsman  had  built 
nuclear  power  plants  before  joining  BP,  and 
then  run  North  Sea  oil  rigs.  He  had  even 
revamped  the  company’s  HR  department  but 
had  never  implemented  an  ERP  system  or 
negotiated  an  IT  outsourcing  deal.  Leggate, 
however,  had  built  a  reputation  as  a  tough 
manager  not  afraid  to  cut  costs  and  invest  in 
technology  to  boost  productivity.  Browne 
admired  Leggate’s  work  in  the  North  Sea  and 
Azerbaijan  and  made  him  CIO  in  January  of 
1 999,  just  as  the  BP- Amoco  deal  was  closing. 

So  began  a  partnership  that’s  lasted  five 
years  and  counting.  It’s  a  relationship  in  which 
the  CIO  embodies  the  CEO’s  philosophy.  Leg- 
gate  has  responded  to  the  challenge  by  acting 


Leggate’s  part,  since  the  start  of  the  year,  he 
has  personally  assured  Browne  and  other  top 
managers  that  BP’s  $1.7  billion  IT  budget  is 
spent  in  areas  that  will  bring  maximum  return. 

In  a  profession  where  an  average  tenure  is 
four  years  and  nine  months,  Leggate’s  five 
years  as  BP’s  CIO  provides  lessons  in  manag¬ 
ing  up,  in  leading  by  example  and  in  keeping  a 
focus  on  corporate  goals.  Lor  starters,  it  helps 
to  be  driven.  Leggate,  like  his  boss,  says  he  likes 
to  do  things  ahead  of  competitors.  He  says  that 
BP  is  a  first-mover  because  “it’s  in  the  genes,” 
adding  that  “time  and  time  again,  it  is  shown 
there  are  no  prizes  for  coming  in  second.” 

Drilling  for  Savings 

BP’s  headquarters,  a  stone’s  throw  from 
Buckingham  Palace,  faces  Saint  James’s 
Square,  one  of  London’s  oldest  and  most 
prestigious  addresses.  Dukes  and  earls  popu¬ 
lated  the  square  in  the  early  1 8  th  century  and 
both  Gens.  Eisenhower  and  de  Gaulle  made 
their  World  War  II  headquarters  here.  Inside 
BP’s  offices,  however,  all  remnants  of  Eng¬ 
land’s  history  are  replaced  by  its  ultramod- 


We  Tiinkof  IT  as  digital  business— an  activity 
whic  al  owsustorocus  nthe:  Brief  its  that 
the  businessandt*  :h  no  logy  can  bring  in 

comt  ination.”  -BP  CEO  John  Browne 


could  change  the  nature  of  the  business  itself. 
We  think  of  this  area  as  digital  business — an 
activity  which  allows  us  to  focus  on  the  bene¬ 
fits  that  the  business  and  technology  can  bring 
in  combination.” 

As  Browne  set  his  philosophy  in  motion,  a 
problem  came  up:  BP  needed  a  new  CIO. 

Enter  John  Leggate 

The  CIO  job  at  BP  opened  up  in  1998,  dur¬ 
ing  the  dotcom  frenzy.  John  Cross,  Browne’s 
IT  chief  and  a  23-year  BP  veteran,  was  leav¬ 
ing  to  join  an  Internet  venture.  Browne  knew 
he  needed  a  CIO  with  a  deep  knowledge  of  his 
company’s  philosophy,  a  willingness  to  launch 
a  massive  systems  integration  project  while 


decisively  as  a  cost-cutter  in  mergers;  as  a  risk- 
taker  in  trying  out  new  Internet  and  wireless 
technologies;  and  as  a  pragmatist  in  seeking 
payback  for  those  investments.  All  the  while, 
Leggate,  part  of  BP’s  senior  leadership  team, 
has  pushed  hard  for  top  executives  to  consider 
IT’s  importance  to  BP’s  vision. 

In  action,  that  means  that  during  the 
Amoco  merger  Leggate  and  his  group — 
dubbed  the  digital  business  team — quickly 
found  duplication  within  BP  and  Amoco’s  IT 
departments  and  slashed  redundant  jobs  and 
programs  (BP  declines  to  give  a  specific 
count).  The  team  has  worked  nonstop  at  inte¬ 
grating  processes  and  systems  while  out¬ 
sourcing  dozens  of  key  IT  services.  And  for 


ern,  open  floor-plan  architecture.  Earnest 
looking,  nattily  dressed  executives  scurry  up 
and  down  curved  stairways  that  lead  to  floors 
of  clutter-free  desks,  surrounded  by  small, 
glass-paneled  offices.  At  the  top  of  the  open 
stairwell  lie  the  executive  suites  of  Browne, 
who  was  knighted  in  1 998  and  has  since  been 
known  as  Lord  Browne  of  Madingley.  A  few 
floors  below,  Leggate  (who  recently  was 
named  a  Commander  of  the  British  Empire, 
one  step  below  knighthood)  works  at  a  lap¬ 
top  in  his  spare  office. 

Dressed  in  a  crisp  dark  suit  and  bright  blue 
tie,  Leggate  likes  to  talk  about  his  interest  in 
technology  and  BP’s  accomplishments  but  is 
self-effacing  and  vague  when  asked  about  his 
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parties’  systems,”  says  Daru,  who  is  based  in 
Warrenville,  Ill.  “There  are  no  right  or  wrong 
answers,  but  you  need  to  make  a  call,  or  you 
will  be  arguing  for  years.” 

Leggate  was  given  24  months  to  find  his 
half-billion  dollars  in  savings,  but  it  took  only 
11.  “They  clearly  decimated  Amoco,”  Cross 
says,  noting  that  Leggate  effectively  imposed 
BP’s  agenda  to  outsource  wherever  possible 
and  trim  IT  staff  at  Amoco  and  subsequent 
acquisitions.  After  his  early  success  in  cutting 
costs,  Leggate ’s  colleagues  gave  him  the  nick¬ 
name  “Shiny  Brain,”  a  moniker  that  also 
refers  to  his  immaculately  shaved  head. 

The  integration  tasks  remain  a  major  con¬ 
cern  for  Leggate ’s  team.  With  more  than  100 
ERP  systems  and  dozens  of  payroll  systems, 
BP  continues  to  work  its  way  through  a 
morass  of  back-office  integration.  With 
merged  companies,  Daru  says,  “We  always 


own  background.  “It’s  not  about  me,  it’s 
about  what  my  team  has  done,  ”  he  says  in  his 
lilting  Scottish  accent. 

This  much  he’ll  confirm:  Leggate  got  his 
start  in  the  energy  field  constructing  nuclear 
power  plants  before  joining  British  Petroleum 
in  1979.  At  BP,  he  made  his  name  as  an 
executive  who  could  take  on  a  problem  and 
quickly  produce  results.  “The  CIO  job  came 
as  a  complete  surprise,”  says  Leggate.  “I  have 
a  wide  range  of  experiences,  which  allows  me 
to  interact  with  the  businesses  and  relate  to 
and  understand  their  challenges  not  as  an  out¬ 
sider,  but  as  someone  who’s  done  it  himself. 
That’s  a  great  selling  point  for  a  CIO.” 

Leggate  was  surprised  to  be  a  CIO  candi¬ 
date,  but  unbeknownst  to  him,  his  predeces¬ 
sor  had  eyed  him  as  a  possible  successor. 
When  John  Cross  left  BP  in  1998  to  form  his 
own  Internet  consultancy,  the  company  con¬ 
sidered  a  broad  search.  Cross  remembered 
Leggate ’s  interest  in  technology  and  says  he 
was  particularly  struck  by  Leggate’s  work 
running  an  aging  North  Sea  oil  field.  Leggate 
needed  to  slash  costs,  but  instead  of  cutting 
across  the  board,  he  decided  to  boost  spending 
in  technology  designed  to  help  automate  the 
drilling  process.  The  result:  a  more  automated 
oil  field  that  continued  to  produce  crude  and 
revenue.  “John  was  always  proactive  in 
deploying  technology,”  Cross  says.  When 
asked  about  his  IT  investments  while  work¬ 
ing  on  oil  and  gas  fields,  Leggate  says,  “I  used 
to  bet  on  technology  even  in  a  down  market.  ” 

Cross  proposed  Leggate’s  name  to  Browne, 
who  approved  it  over  the  objections  of  a  cou¬ 
ple  of  managers  who  balked  at  losing  one  of 
their  top  executives.  On  a  trip  back  to  Lon¬ 
don  from  Azerbaijan,  Leggate  met  with 
Browne  and  accepted  the  CIO  job  just  as  the 
company  was  starting  the  Amoco  merger.  “I 
have  a  good  track  record  of  bringing  things 
together,”  Leggate  says,  theorizing  on  why  he 
was  chosen  for  the  job.  “Pm  good  at  driving 
base  costs,  finding  value  and  making  the 
whole  thing  work.”  To  the  point:  BP  was 
using  10,000  software  applications  across  the 
company  when  he  became  CIO.  Within  a 
year,  they  had  scrapped  3,000  and  hired  out¬ 
side  contractors  to  manage  another  5,000. 


BP  Vital  Statistics 

Headquarters:  London 

History:  Anglo-Persian  Oil  was  formed 
in  1909  by  English  adventurer  William 
D’Arcy  and  Burmah  Oil,  and  was  the  first 
company  to  strike  oil  in  the  Middle  East. 
The  British  government  took  a  51  per¬ 
cent  stake  in  1914.  In  the  United  States, 
Amoco  emerged  from  Standard  Oil 
Trust,  organized  by  John  D.  Rockefeller 
in  1882.  Anglo-Persian  tookthe  name 
British  Petroleum  in  1954.  The  English 
company  merged  with  Amoco  in  1998, 
forming  BP  Amoco,  creating  a  new  oil 
giant  that  agreed  the  next  year  to  buy 
U.S. -based  Atlantic  Richfield.  Known  as 
BP  since  2000. 

Sales  in  2003:  $236  billion 

Employees:  100,000  in  more  than 
100  countries 

IT  spending:  $1.7  billion  per  year 


Drilling  the 
BP  Way  into  Amoco 

As  Leggate  stepped  in  as  CIO  in  January  1999, 
he  faced  the  overwhelming  challenge  of  inte¬ 
grating  conservative,  Chicago-based  Amoco’s 
massive  IT  operations  into  BP,  which  had  been 
on  an  outsourcing  binge  since  the  early  1990s 
and  had  already  consolidated  dozens  of  data 
centers  and  outsourced  much  of  its  help  desk 
and  application  support  work.  By  contrast, 
Amoco  built  systems  in-house,  and  IT  staffers 
feared  losing  their  jobs.  Leggate  began  work¬ 
ing  with  Phiroz  P.  Darukhanavala,  then  vice 
president  for  IT  merger  integration  and  soon 
to  become  the  company’s  CTO  and  the  hands- 
on  leader  of  the  integration  efforts,  and  set  out 
to  identify  overlaps  in  the  IT  departments. 
Leggate  and  Darukhanavala  (known  as 
“Daru”)  say  they  learned  from  the  Amoco 
merger  the  importance  of  spelling  out  the 
“rules  of  engagement”  to  designate  who  will 
create  the  integration  plan.  In  the  Amoco  case, 
BP  ultimately  stepped  in  and  imposed  its  will 
on  Amoco,  standardizing  desktops  on  a  BP 
operating  environment  and  scrapping  much 
of  Amoco’s  in-house  IT  systems,  keeping  only 
Amoco’s  SAP  platform  for  U.S.  operations. 

“You  have  to  make  it  crystal  clear  who  is 
in  charge  when  you  are  integrating  two  corn- 


focus  on  getting  employees  connected  first  so 
that  from  day  one  people  can  communicate 
with  anyone  in  the  company  with  merged  net¬ 
works  and  e-mail.  But  in  all  these  mergers,  the 
back  -office  stuff  was  untidy.  It  will  be  a  matter 
of  years  before  it  is  all  cleaned  up.” 

Today,  BP  is  working  to  consolidate  more 
than  400  data  centers  and  server  farms  around 
the  world,  with  plans  to  reduce  the  number  to 
“a  handful”  in  the  coming  few  years. 

The  emphasis  on  outsourcing  is  by  design. 
Leggate  is  pursuing  BP’s  pioneering  strategy, 
which  dates  to  the  early  1990s  when  Browne 
and  Cross  sought  a  competitive  advantage 
through  efficient  ways  of  buying  IT  services. 
BP  still  outsources  on  a  large  scale,  with  every¬ 
thing  from  telecoms,  application  develop¬ 
ment,  data  centers  and  help  desk  provided  by 
vendors.  The  company  took  the  model  fur¬ 
ther  in  1999  when  it  outsourced  HR  back- 
office  processes  to  the  Internet  company  Exult 
in  a  $600  million  deal  that  transferred  most 
U.S.  and  U.K.  HR  services  to  a  Web  portal. 

When  the  strategy  began,  outsourcing  dras¬ 
tically  cut  BP’s  IT  budget  and  headcount.  In 
BP’s  exploration  unit  (then  led  by  Browne), 
outsourcing  drove  an  IT  budget  drop  from 
$360  million  in  1989  to  $132  million  in  1995. 

Now,  Leggate  says,  the  company  has  mod¬ 
erated  the  pace  of  outsourcing.  Both  Daru  and 
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Leggate  say  BP  has  learned  to  limit  outsourc¬ 
ing  contracts  to  three  years  and  to  avoid  forc¬ 
ing  alliances  between  outside  vendors.  In 
November  1 999,  BP  made  a  $650  million  bet 
to  outsource  telecom  services  to  WorldCom, 
before  its  2002  accounting  fraud  scandal  was 
exposed.  “Instability  in  that  market  has 
caused  us  to  diversify  our  buying  portfolio,  to 
spread  our  risk,”  Leggate  says. 

Daru,  who  calls  himself  Leggate ’s  right- 
hand-person  and  quiet  adviser,  notes  that  the 
company  is  gradually  reducing  the  number  of 
ERP  systems  and  is  moving  away  from  best- 
of-breed  packages  toward  more  integrated 
suites  for  HR,  accounting,  retail  and  other 
back-office  systems.  “We’re  not  integrating 
for  the  heck  of  it,”  Daru  says,  adding  that  a 
clear  payback  drives  integration  efforts.  Daru 
calls  Leggate  a  fast  learner  and  considers  part 
of  his  job  to  cultivate  ties  to  the  IT  vendor 
world  while  Leggate  maintains  the  critical  link 
to  the  BP  executive  suite. 

Digital  Boom  and  Bust 

Once  done  with  the  initial  budget  slashing 
from  the  BP- Amoco  merger,  Leggate  set  out 
to  invest  heavily  in  Internet  technology.  With 
Browne’s  backing,  he  spent  $250  million  in 
2000  on  initiatives  to  get  BP  employees  onto 
a  common  operating  environment.  He 
bought  Internet-linked  laptops  for  more  than 
half  of  the  company’s  employees,  including 
top  management  and  oil  rig  workers.  Now, 
80  percent  of  the  company’s  1 00,000  employ¬ 
ees  have  computers,  2,000  of  which  are  “liv¬ 
ing  beyond  the  firewall”  in  an  experiment 
with  broadband  wireless  connections  that 
puts  them  ahead  of  competitors  Shell  and 
Exxon  Mobil.  “One  of  my  main  jobs  is  to 
allow  people  here  to  be  connected  wherever 
you  may  touch  down.  If  you’re  in  Jakarta,  Sin¬ 
gapore  or  Houston,  you’re  always  in  touch 
with  your  colleagues,”  Leggate  says. 

Leggate  and  Browne’s  early  enthusiasm  for 
all  things  Internet-related  reflects  the  first- 
mover  company  ethos  also  evident  in  BP’s 
acquisition  and  outsourcing  strategies.  Some¬ 
times,  they  admit,  they  have  gone  too  far. 

Both  Leggate  and  Browne  bet  aggressively 
(and  some  would  say  unwisely)  on  online  pro- 


Lessons  from 
Jo  in  Leggate 


»  Know  your  CEO’s  strategy  and  priorities. 

»  Make  sure  IT  strategy  reflects  your 
company’s  corporate  philosophy. 

»  Take  advantage  of  any  non-IT  business 
experience  you  have  had  to  better  commu¬ 
nicate  IT  needs  with  business  executives. 

»  Outsource  aggressively,  but  don’t 
sign  lengthy  contracts,  and  work  to  keep 
control  of  key  strategy  and  core  intellectual 
property. 

»  Don't  force  alliances  between  outside 
vendors. 

»  Don’t  lose  enthusiasm  for  new  technolo¬ 
gies  even  if  burned  in  the  past. 

»  Choose  your  CTO  carefully  and  develop 
a  close  relationship. 

»  After  a  merger,  focus  on  integrating  the 
front  end  so  that  employees  can  effectively 
communicate  on  day  one. 

»  When  integrating  two  companies'  sys¬ 
tems,  make  sure  it’s  clear  who  is  in  charge. 


curement,  predicting  large  and  quick  gains  in 
the  business-to-business  area.  In  1999, 
Browne  predicted  with  fanfare  that  BP  would 
move  95  percent  of  its  $25  billion  in  procure¬ 
ment  to  the  Web  by  the  beginning  of  2001. 
When  the  company  was  able  to  achieve  only 
4  percent  of  purchasing  online  by  that  year, 
Browne  said  in  a  speech  delivered  at  Oxford 
University  (and  cowritten  by  Leggate):  “To 
have  reached  that  sort  of  level  would  have 
required  not  just  closely  linked  internal  sys¬ 
tems  but  also  well-developed  portals  and  a 
network  of  suppliers  linked  into  a  single 
process.  Revolutions  don’t  come  easily.” 

In  retrospect,  Leggate  says  now  that  while 
the  expectations  were  overblown,  the  vision 
remains.  “Clearly,  digitizing  the  supply  chain 


in  all  its  facets  will  be  a  long  journey,  but  the 
dream — in  a  business  context — has  the  touch 
and  feel  of  an  Amazon.com,”  he  says.  He  adds 
that  BP  will  remain  a  first-mover  where  they 
see  a  clear  payback.  “Technological  break¬ 
throughs  like  Web  services  and  RFID  tagging, 
all  of  these  will  accelerate  the  drive  toward  dig¬ 
itization  of  the  supply  chain,”  he  says. 

Cross,  himself  afloat  in  the  dotcom  bubble 
at  the  time,  says  that  BP’s  enthusiasm  may 
have  cost  them.  “They  did  play  with  tangen¬ 
tial  things,  especially  in  B2B,  and  they  surely 
lost  a  lot  of  money  on  that,  as  did  everyone 
else,”  he  says.  Leggate,  who  embraced  the 
Internet  more  enthusiastically  and  publicly 
than  other  oil  industry  CIOs,  still  proclaims 
that  BP’s  goal  is  to  “  live  on  the  Web.  ”  It  sounds 
a  bit  dated  as  a  motto,  but  Leggate  (echoing 
Browne)  stresses  the  Internet  never  changed 
the  laws  of  economics  or  the  nitty-gritty 
nature  of  finding  oil  and  gas.  Leggate  says: 
“Are  we  getting  more  for  less  now?  That 
answer  is  yes.  We  can  genuinely  show  about  a 
5  percent  per  annum  trendline  over  five  years 
in  savings  from  technology.” 

A  Business-IT 
Pipeline 

According  to  Jill  Feblowitz,  an  analyst  at 
AMR  Research,  all  of  the  oil  giants  are  “on 
the  same  page”  wrestling  with  ERP  consoli¬ 
dation  and  pouring  dollars  into  “digital  oil 
field”  initiatives  that  promise  increased  oil 
production  through  3-D  imaging  and  real¬ 
time,  automated  drilling  techniques.  “Every¬ 
one  is  focused  on  creating  more  flexibility  with 
these  initiatives  because  of  the  heightened 
uncertainties  in  the  Middle  East  and  other 
regions,”  Feblowitz  says.  The  challenge  for 
CIOs  at  the  oil  giants,  says  Dick  Cooper,  direc¬ 
tor  of  Deloitte  Consulting’s  global  oil  and  gas 
practice,  “is  to  marry  these  new  technologies 
with  cost  and  budget  information.” 

Analysts  characterize  BP’s  technology 
strategy  as  aggressive,  but  they  also  agree  that 
when  it  comes  to  aligning  IT  and  business 
strategy,  BP  seems  to  be  further  along  than  its 
rivals.  That  task  has  been  made  easier  by 
Browne’s  interest  in  IT  and  Leggate ’s  business 


70  CIO  APRIL  15,  2004  •  www.cio.com 


SUPPORT  \r  SERVICE 


DESIGN 


A  HOLE-IN-ONE  AT  THE  OFFICE 


END-TO-END  TECHNOLOGY  AND  EXPERTISE  MAKES  IT  HAPPEN 


Catalyst  3750  24  Port 

C762LN 

zaurus  SL-6000 

FortiGate  300 

10/1 00/1  OOOBaseT  Switch 

Color  Laser  Printer 

Handheld 

Antivirus  Firewall 

•  Optimized  for  high-density 

■  Up  to  20ppm  B8<W  and  color 

■  4”  640  x  480  full  VGA  display 

•  200Mbps  firewall  throughput 

Gigabit  Ethernet  deployments 

■  Ethernet  10/IOOBaseTX 

■64MB  SDRAM,  built-in  WiFi 

■  400,000  concurrent  sessions 

■  1RU  stackable  multi-layer  switch 

■  Intelligent  Color  Care  Technology 

■  Linux 

•  1500  dedicated  tunnels 

$4189 

#448917 

$1599 

#4822095 

s699 

#4879737 

$5995 

#462799 

ThinkPad  X40 

•Only  2.7  lbs.,  .8"  thin 
■  1GHz  Centrino  P-M 
■12.r  TFT  display 

$1499  $1799 

#4841464  #4841472 

with  optional 
UltraBase  X4 
&  combo  drive 


©  2004  PC  Connedion.  All  rights  reserved.  PC  Connedion  is  a  trademark  of  PC  Connedion,  Inc.  or  its  subsidiaries.  All  other  trademarks  remain  the  property  of  their  respedive  companies. 


PC  Connection’ 


www.pcconnection.com 


800.986.271  2 


we  solve  IT" 


Management  Strategies  |  BP 


CTO  Phiroz  P.  Darukhanavala  (“Daru”)  led  BP's  i 
with  Amoco  and  says  it  will  be  years  before 
systems  are  cleaned  up. 


experience.  “What  was  unusual 
about  John  Browne  was  that  here’s  a 
CEO  that  not  only  thought  IT  mat¬ 
tered  but  made  it  clear  by  his 
actions,”  says  Michael  Earl,  dean  of 
Templeton  College  at  Oxford  Uni¬ 
versity  and  an  expert  on  the  CIO  role 
and  on  CEOs  who  have  pushed  an 
IT  agenda.  Earl  adds  that  Cross  set 
the  stage  for  Leggate  by  working 
closely  with  Browne  and  getting  top- 
level  approval  for  his  bold  decision 
to  outsource  much  of  IT  in  the 
1990s. 

The  origin  of  BP’s  aggressive  style 
lies  in  a  management  structure  that 
is  less  hierarchical  than  its  comp¬ 
etitors.  Once  a  rigid,  state-owned 
company,  BP’s  structure  shifted  dra¬ 
matically  after  the  British  govern¬ 
ment  sold  its  final  30  percent  share  in 
1987.  When  new  management  took  over  in 
1 992,  the  company  was  split  up  into  150  busi¬ 
ness  units  with  managers’  pay  linked  to  their 
unit’s  profits.  Now,  ambitious  managers  like 
Leggate  must  demonstrate  a  business  case  for 
each  investment.  Leggate  describes  his  task  of 
assuring  top  management  that  money  is 
wisely  spent  on  IT  projects  as  a  “restraint 
model”  that  involves  both  challenges  by  out¬ 
side  experts  and  a  robust  debate  within  the 
senior  leadership  team. 

Even  after  the  disappointment  of  the  Inter¬ 
net  bust,  Leggate  retains  a  hard-to-restrain 
glee  when  talking  about  technology’s  prom¬ 
ise.  (Cross,  who  is  in  regular  touch  with  Leg- 
gate,  says  the  CIO’s  enthusiasm  helps  him  sell 
BP  executives  on  the  importance  of  IT.) 

For  a  presentation  on  radio  frequency  ID 
tags  to  Browne  and  40  other  executives,  Leg- 
gate  invited  colleagues  from  Procter  &  Gam¬ 
ble  and  the  brewer  Scottish  Courage  to  talk 
about  how  they  had  used  RFID  to  verify  the 


BP  was  one  of  100  companies  recognized  for 
excellence  in  integration  in  C/O's  CIO-100 
Awards  in  2002.  BP  and  six  others  were  profiled 
in  a  story  on  integration  after  a  merger  or  acquisi¬ 
tion.  To  read  MERGERS  AND  ACQUISITIONS,  go 
towww.cio.com/printlinks.  CIO  COfTI 


age  and  freshness  of  a  product  and  to  track 
pallets  and  crates.  “Our  people  went  away 
really  enthused,  ”  Leggate  says  of  the  meeting. 
“We  decided  to  harness  that  energy  level  and 
launch  four  major  projects.”  BP  is  imple¬ 
menting  sensory  networks  using  RFID  chips 
for  applications  such  as  tracking  rail  cars  in  the 
chemical  business.  “It’s  important  to  see,  and 
to  show,  whether  there  is  a  business  case,  as 
opposed  to  just  chasing  a  technical  dream,” 
Leggate  says. 

Exploring  for  Value 

In  August  2003,  Browne  made  BP  the  first 
Western  oil  company  to  buy  a  major  equity 
piece  of  an  integrated  Russian  oil  and  gas  com¬ 
pany,  giving  BP  a  50  percent  share  in  a  venture 
dubbed  TNK-BP.  Two  months  later,  the  arrest 
of  Mikhail  Khodorkovsky,  president  of  Yukos, 
the  country’s  largest  oil  company,  roiled  the 
Russian  financial  markets.  Browne  voices  con¬ 
fidence  in  the  investment,  but  analysts  say  the 
jury  is  still  out. 

Risk,  however,  is  integral  to  BP’s  strategy. 
To  Leggate,  the  culture  of  risk-taking  means 
that  projects  such  as  those  using  RFID  are 
adopted  quickly  and  wholeheartedly  if  they 
can  help  the  bottom  line.  New  deals  like  the 
one  with  Russia’s  TNK  mean  the  integration 


some  other  types  of  applications 
low  but  is  still  in  experimental, 

gpE  although  promising,  stages, 

lapfcil  From  the  outside,  BP  appears  to 

have  embraced  risk  more  than  its 
rivals  by  doubling  in  size,  venturing  into  unsta¬ 
ble  regions  or  diving  headfirst  into  the  Internet 
and  other  technologies.  And  many  of  the  risks 
seem  to  have  paid  off.  For  example,  the 
Amoco  buy  turned  BP  into  a  major  supplier 
of  natural  gas,  which  has  tripled  in  price  since 
1998.  Soon  after,  Exxon  bought  Mobil  and 
Chevron  took  over  Texaco.  Today,  BP  vies 
with  Royal  Dutch/Shell  for  the  title  of  second 
largest  integrated  oil  company  after  Exxon 
Mobil. 

At  BP’s  London  offices,  however,  reckless¬ 
ness  seems  a  foreign  concept.  “Our  natural 
bias  for  innovation  has  to  be  handled  carefully 
so  that  we  always  find  the  business  point,” 
Leggate  says.  He  adds  later  that  BP  “under¬ 
takes  a  high  and  rigorous  degree  of  analysis 
and  testing  before  it  places  its  bets.”  Although 
Leggate  relishes  discussing  BP’s  philosophy, 
the  CIO  post  at  Britain’s  largest  company  can 
be  a  lonely  one,  Leggate  has  told  Cross.  “It’s 
dangerous  territory  because,  like  a  CEO,  you 
are  always  getting  shot  at,”  Cross  says.  “John 
is  an  ebullient  character,  though.  He’s  like  a 
big  rubber  ball  that  can  take  the  knocks  and 
keep  bouncing  along.  ”  BE] 


Susannah  Patton  is  a  freelance  writer  based  in  Paris. 
Send  comments  to  letters@cio.com. 


Learn  More  About  M&A  Integration 


challenges  will  continue.  Leggate 
prefers  to  delegate  systems  integra¬ 
tion  details  to  Daru’s  team  and 
focus  on  strategy  and  cost  controls. 

Leggate ’s  team  is  moving  away 
from  proprietary  systems  toward 
commodity  computing  and  open- 
source  architectures.  The  group  is 
looking  at  using  a  new  class  of  soft¬ 
ware  that  will  allow  far-flung 
employees  to  access  applications 
over  the  Internet  and  to  download 
only  the  piece  of  an  enterprise  pro¬ 
gram  they  need.  According  to 
Daru,  this  type  of  software-on- 
demand  would  involve  SAP  and 
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CIO  Partnerships 


CIOs  and  venture  capitalists  are  back  together.  VCs 
are  eager  for  CIOs’  insights  on  startups.  CIOs  get 
access  to  and  influence  overthe  latest  technology. 

BY  KIM  GIRARD 


7  4 


oger  Sippl  is  a  veteran  Silicon 
Valley  entrepreneur  and  executive,  well  known  as  a  founder  of 
CRM  software  company  Vantive  and  database  pioneer  Informix. 
But  that  was  then;  now  venture  capitalists  want  to  know  the 
prospects  of  Sippl’s  latest  startup,  a  Web  services  company 
called  Above  All  Software.  To  find  out,  VC  group  J.P.  Morgan 
Partners  turned  to  its  Technology  Council,  a  group  of  20-plus 
CIOs  and  CTOs  who  gathered  in  Las  Vegas  last  November. 

What  started  as  a  product  pitch  turned  into  a  reality  check. 
The  Technology  Council  members  weren’t  shy  about  letting 
Sippl  know  he  is  ahead  of  their  Web  services  adoption  curve. 
“We’re  still  dipping  our  toes  in  the  water,”  says  Enzo  Micali, 
CTO  of  1-800-Flowers. com,  who  was  one  of  the  few  IT  execs 
present  who  agreed  to  give  the  technology  a  try. 

Tough  love,  perhaps,  but  this  is  the  kind  of  insight  from  IT 
leaders  that  startup  companies  and  their  venture  capitalist 
backers  crave.  Stung  by  the  failure  of  so  many  startups  after  the 
technology  bubble  burst,  these  days  VC  firms  like  J.P.  Morgan 
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JOSH  LEVINE 
CTO,  E-Trade 

Venture  capitalist-sponsored 
CIO  councils  are  “a  forum 
where  there’s  no  pressure.” 


WILL  JOHNSON 

VC,  J.P.  Morgan  Partners 

‘We  spend  enough  time  with 
our  CIOs  to  understand  to  a 
pretty  strong  degree  what’s 
important  to  them." 


BUCK  FRENCH 

VC,  J.P.  Morgan  Partners 

The  CIOs  were  saying,  ‘I  don’t 
know  if  the  TCO  for  Linux  is 
there.'  A  year  later,  a  bunch  of 
C I  Os  a  re  ado  pt  i  ng  L  i  n  u x,  ” 
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CIO  Partnerships 


Partners  are  relying  on  CIO  advisory  groups. 
The  Technology  Council  guides  J.P.  Morgan 
Partners  (JPMP)  on  technology  and  provides 
straight  talk  on  whether  a  portfolio  company 
is  selling  goods  that  IT  execs  want  to  buy. 

In  exchange  for  their  wisdom,  CIOs  get  a  first 
peek  at  new  technologies  and,  if  they  choose,  a 
chance  to  work  with  a  startup  and  shape  the 
future  features  of  its  product.  “It’s  almost  like 
having  your  own  R&D  arm,”  says  Lars  Rabbe, 
CIO  of  Yahoo.  “You  get  all  these  startup  com¬ 
panies  so  you  don’t  have  to  do  it  yourself.  ” 

Besides  the  insight  into  new  technologies, 
CIOs  who  participate  in  V C-sponsored  coun¬ 
cils  say  the  chance  to  connect  with  their  peers 
is  a  huge  benefit.  A  CIO  thinking  of  partici¬ 
pating  in  such  groups  must  be  careful  to  avoid 
conflicts  of  interest,  however,  and  should 
make  sure  that  the  VC  firm  knows  the  CIO’s 
needs  well  enough  so  that  it  doesn’t  waste  his 
time  on  irrelevant  technologies. 

HOW  CIO 

COUNCILS 

WORK 

The  specifics  of  VC-CIO  relationships  vary 
quite  a  bit.  There  are  about  700  venture  capi¬ 
tal  outfits  in  the  United  States,  ranging  from 
firms  that  seed-fund  new  ventures  to  later-stage 
investors  willing  to  gamble  a  lot  of  money  on  a 
company  with  a  product.  Though  the  National 
Venture  Capital  Association  and  other  organ¬ 
izations  that  track  the  industry  can’t  pinpoint 
the  number  of  VC-organized  CIO  councils, 
dozens  of  firms  are  quietly  using  the  groups  as 
a  crucial  part  of  their  investment  strategy. 

Larger  firms  such  as  JPMP  and  New  Enter¬ 
prise  Associates  gather  their  CIO  groups  once 
or  twice  a  year  in  person  and  more  often  by 
telephone.  Clearstone  Venture  Partners, 
which  runs  a  midsize  fund,  prefers  a  more 
loosely  knit  CIO  group  with  fewer  members 
and  roundtable-style  get-togethers.  A  few  ven¬ 
ture  firms  hire  CIOs  to  provide  in-house 
expertise  or  invest  in  CIO  groups.  For  exam¬ 
ple,  Rabbe  was  an  executive-in-residence  at 
Clearstone  for  seven  months  before  taking  a 
job  as  CIO  at  Yahoo.  Mobius  Venture  Capital 


Due  Diligence  for 
VC  Groups 

Four  criteria  for  joining  a 
VC-sponsored  CIO  council 

CIOs  who  have  been  invited  by  a  venture 
capitalist  to  join  a  CIO  council  should 
first  do  some  sleuthing.  Here  are  some 
questions  to  consider  before  starting  a 
work  relationship  with  a  VC. 

Does  it  have  stellar  references? 

Call  around  and  ask  a  few  CEOs  or 
other  CIOs  which  VC  firms  they  have 
worked  with  and  how  that  worked  out. 

Is  the  firm  successful? 

Check  its  long-term  record.  Dotcom 
success  was  fleeting.  You  want  to  know 
that  this  company  can  do  more  than 
execute  an  IPO  strategy. 

How  do  the  partners  come  across? 

Follow  your  instincts.  Do  they  seem 
humble  or  arrogant?  Do  they  speak 

poorly  about  their  competition?  Would 

. 

you  buy  a  used  car  from  them? 

How  big  is  its  current  fund? 

Will  it  be  able  to  keep  the  startup  you 
are  eyeing  in  business  until  it’s  ready  to 
go  public?  If  the  company  goes  belly-up, 
so  does  support  for  the  product.  -K.G. 


invested  in  the  Feld  Group,  a  consultancy 
comprising  former  CIOs  who  helped  revamp 
the  IT  departments  of  Fortune  500  companies 
such  as  Delta  Air  Lines  and  PepsiCo.  The  Feld 
Group,  which  is  now  owned  by  tech-services 
giant  EDS,  helped  give  Mobius  “visibility  into 
the  world  of  CIOs,”  says  Bill  Burnham,  a  for¬ 
mer  managing  director  at  Mobius. 

J.P.  Morgan  Partners,  a  private  equity  firm 
with  a  whopping  $19  billion  in  assets  under 
management,  held  its  first  Technology  Coun¬ 
cil  meeting  in  January  2003.  Since  then,  the 
group  has  grown  to  24  CIO  members,  who 
collectively  represent  $6  billion  in  technology 
spending.  Two-thirds  of  the  CIOs  on  the 


council — including  those  of  Domino’s  Pizza, 
1 -800-Flowers.com,  Guitar  Center  and 
House  of  Blues — come  from  JPMP’s  portfolio 
companies.  (The  firm  invests  in  small  to  mid¬ 
size  companies.)  One-third  of  the  council 
members  are  “outsider”  CIOs,  including 
those  from  E-Trade,  Otis  Elevator,  Price¬ 
line.com  and  the  Vanguard  Group. 

Council  members  often  hail  from  former 
JPMP  portfolio  companies,  such  as  Kinko’s 
(which  was  acquired  in  February  by  FedEx). 
Sometimes  they  have  personal  relationships 
with  council  organizers.  Vanguard  Group 
Managing  Director  of  IT  Tim  Buckley,  for 
example,  was  a  Harvard  Business  School 
classmate  of  JPMP  partner  Buck  French.  They 
are  invited  on  the  council  to  give  it  more  depth 
and  provide  an  independent  perspective. 

Initially,  the  Technology  Council  was  slated 
to  meet  in  person  once  a  year.  But  technology 
changes  too  quickly  to  wait  that  long — partic¬ 
ularly  if  his  company  wants  to  stay  ahead  of 
investment  trends,  says  French,  an  entrepre¬ 
neur- turned-VC  who  was  the  group’s  found¬ 
ing  father.  “We  had  a  conference  call  about 
Linux  [last  year]  and  the  CIOs  were  saying,  ‘I 
don’t  know  if  the  TCO  for  Linux  is  there,”’  he 
says.  “A  year  later,  a  bunch  of  CIOs  are  adopt¬ 
ing  Linux.”  To  keep  up  with  technological 
change,  Will  Johnson,  who  chairs  the  council, 
bumped  up  the  meeting  schedule  to  twice 
yearly  and  added  monthly  teleconferences. 

VCs  view  the  CIO  councils  as  crucial  screen- 
ers  of  new  technology,  warding  them  off  of 
costly  investment  boondoggles.  Carl  Showal- 
ter,  a  general  partner  at  Lightspeed  Venture 
Partners,  says  CIOs  help  him  separate  startups 
that  he  calls  “vitamins” — companies  with 
technology  he  considers  more  of  an  add-on 
feature  than  a  problem-solver — from  those 
that  are  true  pain-relieving  “aspirin.”  VCs  are 
more  interested  in  the  latter  because  it  takes 
them  four  or  five  years,  on  average,  to  make 
money  from  selling  a  startup  or  taking  it  pub¬ 
lic.  The  last  thing  a  VC  wants  is  to  fund  a  com¬ 
pany  with  a  me-too  technology  or  a  product 
that  quickly  becomes  obsolete. 

Enthusiastic  approval  from  CIOs  can  mean 
the  difference  between  a  startup  nailing  a 
$10  million  funding  round  or  disappearing. 
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E-Trade  CTO  JOSH  LEVINE,  who  participates  in  a  few  VC-sponsored  CIO  councils, 
says  they  are  among  the  few  venues  where  he  can  have  relaxed  and  real  communication 
with  his  peers. 


Evangelos  Simoudis,  a  partner  at  Apax  Part¬ 
ners  who  coordinates  his  company’s  25- 
member  CIO  advisory  group  meetings,  says 
that  Apax’s  investments  in  several  startups — 
such  as  Bristol  Technology,  a  developer  of 
transaction  monitoring  software — were  influ¬ 
enced  by  council  CIOs  from  companies  such 
as  Bristol-Myers  Squibb  and  Hartford  Insur¬ 
ance.  “Do  these  [CIOs]  become  customers?” 
Simoudis  asks.  “Yes.” 

WHAT’S  IN  IT 
FOR  CIOs 

During  Technology  Council  meetings,  JPMP 
introduces  the  assembled  CIOs  to  technology 
startups  it  helps  fund,  both  to  get  feedback 
and  to  give  the  CIOs  a  chance  to  follow  up  if 
their  interest  is  piqued.  Johnson  says  he  won’t 
waste  the  CIOs’  time  with  a  pitch  that  doesn’t 
offer  something  of  value.  “We’ve  earned  the 
trust  of  these  [CIOs],”  he  says.  “Our  filter  is 
very  high.  We  spend  enough  time  with  them 
to  understand  to  a  pretty  strong  degree  what’s 
important  to  them.”  For  now,  JPMP  is  eye¬ 
ing  investments  in  security,  Web  services, 
wireless  computing,  supply  chain  manage¬ 
ment  and  networking. 

No  matter  how  much  work  the  venture 
partners  put  into  screening  the  companies  that 
appear  before  CIO  councils,  however,  it’s  ulti¬ 
mately  up  to  IT  execs  to  decide  whether  to 
purchase  new  technologies.  Many  CIOs  are 
conservative,  particularly  in  the  aftermath  of 
the  dotcom  bubble.  Others  find  startups — 
particularly  embryonic  companies — a  risky 
proposition. 

At  1 -800-Flowers.com,  Micali  wanted  to 
find  an  easier  way  to  manage  data  from  the 


company’s  many  product  lines.  The  company 
sells  plants,  gift  baskets,  toys  and  many  other 
items  online,  in  company-owned  or  fran¬ 
chised  stores  and  through  catalogs.  Micali  is 
hoping  the  Web  services  software  from  Above 
All  (which  is  backed  by  JPMP  and  other  VC 
groups)  will  help  integrate  orders  that  come 
in  through  call  centers — not  only  within 
1  -800-Flowers.com  but  also  from  its  acquired 


brands  such  as  HearthSong  and  the  Popcorn 
Factory.  Micali  also  wants  to  be  better  pre¬ 
pared  to  tackle  integration  challenges  that 
crop  up  during  future  acquisitions.  “I  don’t 
want  to  reinvent  the  wheel  every  time  we 
acquire  a  company,”  he  says. 

Fouis  Gasparini,  senior  vice  president  of 
Internet  systems  development  for  Wells  Fargo, 
sits  on  a  CIO  council  organized  by  Outlook 
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CIOs  are  pretty  open  about  sharing  their  challenges. 

•  m  m  m  I  - 


but  there’s  an  enormous  willingness 
to  share  issues  and  be  candid.” 


-DOUG  BUSCH,  CIO,  INTEL 
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ENZO  MICALI,  CTO  of  1-800-Flowers.com,  got  access  to  new  Web  services  integration 
software  and  an  introduction  to  Linux  for  data  centers  through  the  J.P.  Morgan  Part¬ 
ners’  Technology  Council. 


Ventures  and  works  regularly  with  several 
other  VC  firms.  He  turns  to  startup  compa¬ 
nies  when  large  technology  vendors  don’t 
have  what  he  needs  to  solve  problems,  such  as 
removing  bugs  during  software  development, 
improving  network  performance  or  service 
levels  or  tracking  Java  development.  “What 
are  we  supposed  to  do,  build  it  ourselves  ?  ”  he 
asks  rhetorically. 

Today,  Gasparini  is  working  with,  among 
other  startup  companies,  Euclid,  which  sells 
software  that  tracks  network  downtime, 
among  other  features.  The  relationship  with 
Euclid  succeeds  for  several  reasons.  First, 
Euclid’s  technology  is  unique,  Gasparini  says. 
Plus,  “  if  Euclid  goes  down,  it’s  not  going  to  get 
Wells  into  the  paper,”  he  says.  Finally,  he  says 


there’s  no  way  the  bank  would  have  received 
from  a  large  company  the  special  attention, 
training  and  time  that  Euclid  spent  with  his 
staff.  “When  you  work  with  startups,  you 
work  with  the  founder,  who  transfers  knowl¬ 
edge  to  our  staff,”  he  says. 

CIOs  who  take  part  in  the  VC  councils  say 
the  gatherings  are  a  surprisingly  candid  forum 
for  airing  problems,  mulling  over  new  tech¬ 
nology  and  discussing  management  issues  such 
as  employee  retention.  “There  are  only  certain 
people  you  can  share  with,”  says  Micali.  Adds 
E-Trade  CTO  Josh  Levine,  who  sits  on  a  few 
VC  councils,  “It’s  a  forum  where  there’s  no 
pressure,  and  you  really  get  a  chance  to  have 
real  communication  between  your  peers.” 

It  was  Levine  rather  than  a  venture  capi¬ 


talist  who  turned  Micali  on  to  Linux.  At  the 
JPMP  Technology  Council  meeting  last 
November,  Micali  chatted  about  the  pros  and 
cons  of  the  open-source  operating  system 
with  Levine,  who  has  become  something  of 
an  expert  on  Linux  from  his  experience 
deploying  it  in  his  data  center.  Intrigued  by 
the  idea  of  using  it  in  his  own  data  center, 
Micali  and  three  staff  members  later  visited 
E-Trade’s  headquarters  in  Manhattan  to  hud¬ 
dle  with  Levine  and  his  crew.  “He  got  me 
pretty  juiced  about  Linux,”  Micali  says. 
“Based  on  those  discussions,  it  is  something  I 
am  now  taking  a  hard  look  at.” 

WISE  COUNSEL 
FOR  CIO 
COUNCILS 

The  VC-CIO  link  became  notorious  for  the 
wrong  reasons  in  the  late  ’90s,  when  reports 
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A  building  is  no  longer 

just  a  place  you  do  business. 

^  r!|An4.  y  4-  nnir  The  best  “partners” make  every°ne  around 

ILD  Cl  blltrlll  Ud  I  Ll  lei.  lll®m  perform  better.  With  building 

technology  solutions  from  Siemens,  your 

building  becomes  more  responsible.  And  can  even  become  a  manageable  asset.  We  create 
and  integrate  core  infrastructure  systems  like  HVAC,  lighting,  energy  management,  fire 
safety  and  security  systems,  so  your  working  environment  is  safer  and  more  comfortable. 
Not  to  mention  more  efficient.  Basically,  we  think  your  building  should  be  working  for 
you.  Not  the  other  way  around.  We  have  65,000  U.S.  employees  working  together  with 
thousands  more  all  around  the  world.  Exchanging  ideas.  Sharing  knowledge.  .And 
strengthening  America’s  infrastructure  and  businesses. 
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surfaced  that  some  IT  executives  received  stock 
or  stock  options,  free  or  deeply  discounted 
products,  and  other  perks  from  startup  com¬ 
panies  they  purchased  from.  In  the  current  eth¬ 
ical  and  regulatory  environment  that’s  placing 
greater  scrutiny  on  financial  moves  of  all  cor¬ 
porate  executives,  however,  even  a  whiff  of 
impropriety  can  be  damaging. 

New  Enterprise  Associates  (NEA)  partner 
Harry  Weller  says  selling  isn’t  an  issue  during 
his  group’s  council  meetings  because  the  com- 


about  a  deal,  he  gets  an  opinion  on  it  from  the 
company’s  legal  department. 

There  are  no  fees  to  join  VC-sponsored 
CIO  councils.  Membership  in  JPMP’s  Tech¬ 
nology  Council  is  purely  voluntary,  French 
says.  Like  other  VC  firms,  JPMP  covers  costs 
related  to  CIO  group  meetings,  but  the  CIOs 
pay  their  own  travel  expenses. 

It’s  up  to  the  CIOs  themselves  to  decide 
how  much  information  they  share  about  their 
companies  at  meetings — especially  if  they  end 


VC-sponsored  CIO  council  effectively,  “you 
really  have  to  understand  their  business,”  says 
Russell,  who  says  he  has  run  CIO  councils  in 
the  past  and  plans  to  start  one  up  again. 

Not  all  CIOs  are  convinced  of  the  useful¬ 
ness  of  VC-sponsored  CIO  councils.  “It’s  too 
early  to  tell  how  successful  the  [JPMP  Tech¬ 
nology  Council]  will  be,”  says  Mark  Laugh- 
lin,  CIO  of  Guitar  Center.  “I’m  not  quite  sure 
if  they  can  provide  the  information  and  net¬ 
working  or  the  exchange  of  information  or 


pany  doesn’t  use  that  time  to  trot  out  its  port¬ 
folio  companies  to  CIOs.  “We  generally  keep 
the  discussion  at  a  higher  level  than  that,” 
Weller  says.  “We  don’t  do  an  NEA  compa¬ 
nies  pageant.” 

Gary  King,  CIO  of  Barnes  &  Noble  and  a 
member  of  Apax’s  CIO  council  since  April 
2002,  hasn’t  had  a  negative  experience  with  a 
venture  capital  firm.  “  Apax  doesn’t  push  stuff 
on  us,”  he  says.  For  instance,  King  is  running 
a  Wi-Fi  hotspot  trial  in  Seattle  with  wireless 
startup  Cometa  Networks.  Apax  is  an  investor 
in  Cometa — but  Barnes  &  Noble  came  across 
the  startup  on  its  own  while  investigating  wire¬ 
less  companies,  not  because  someone  at  Apax 
foisted  the  company  on  them.  Besides,  he  says, 
all  buying  decisions  at  Barnes  &  Noble  go 
through  a  formal  vendor  solicitation  process, 
which  doesn’t  allow  much  room  for  side  deals 
with  startups.  King  says  that  if  he  is  unsure 


Talk  to  Josh  Levine 


As  a  member  of  a  few  IT  advisory 
boards  to  venture  capitalists, 

E-Trade  CTO  Josh  Levine  can  fill  you 
in  on  the  ins  and  outs  of  the  role.  Just  ASK  THE 
SOURCE.  Send  questions  to  Levine  now  through 
April  30.  Go  to  www.cio.com/experts 

cio.com 


up  sitting  next  to  a  rival,  which  can  happen  on 
some  of  the  councils.  But  Intel  CIO  Doug 
Busch,  who  sits  on  several  advisory  councils, 
says,  “CIOs  are  pretty  open  about  sharing 
their  challenges.  We’re  all  cautious  about  the 
competitive  strategies  of  our  companies,  but 
there’s  an  enormous  willingness  to  share  issues 
and  be  candid.” 

Busch  says  that  for  CIO  councils  to  work 
well,  the  VCs  need  to  be  willing  to  spend  the 
time  to  get  to  know  CIOs  and  their  compa¬ 
nies.  At  big  corporations,  IT  can  be  a  byzan- 
tine  maze.  Busch  says  that  oftentimes  VCs  and 
startup  companies  alike  don’t  quite  under¬ 
stand  how  Intel  operates,  which  prevents 
them  from  effectively  forging  the  right  rela¬ 
tionships  and  getting  their  technology  in  front 
of  the  right  people.  As  a  result,  all  sides  lose. 

Scott  Russell,  a  partner  at  Diamondhead 
Ventures,  says  he  understands  the  importance 
of  speaking  CIOs’  language — perhaps  because 
he  was  a  worldwide  technology  manager 
before  he  became  a  VC.  “A  lot  of  VCs  talk  to 
CIOs,  but  if  you  don’t  have  an  appreciation 
for  their  job,  it’s  sometimes  a  hard  conversa¬ 
tion,”  he  says.  “Most  VCs  throw  a  new  com¬ 
pany  over  and  say,  ‘Why  don’t  you  take  a  look 
at  this?’  But  the  CIOs  get  swamped.”  To  use  a 


workgroups  that  will  make  our  time  valu¬ 
able.  ”  What  does  Laughlin  want?  To  talk  with 
the  “best  and  brightest”  about  things  that 
matter  to  him:  vendor  consolidation,  the 
economy  and  Sarbanes-Oxley,  which  he 
believes  creates  a  big  problem  for  CIOs. 
Laughlin,  who  holds  an  MBA  and  an  account¬ 
ing  degree,  is  more  interested  in  solving  the 
business  problems  related  to  his  job  than  find¬ 
ing  the  latest  whiz-bang  technology.  “I  don’t 
have  time  to  mess  around,”  he  says.  “I  want  to 
get  value  for  my  time  invested.  ” 

Nonetheless,  Laughlin  has  thawed  to  the 
occasional  VC  vendor  pitch.  J.R  Morgan  Part¬ 
ners  has  a  stake  in  a  company  named  Profit- 
Logic,  which  helps  retailers  optimize  product 
pricing.  Laughlin  thinks  the  technology  could 
help  Guitar  Center  do  a  better  job  of  analyzing 
profit  margins,  pricing  and  modeling  so  that 
the  company’s  stores  can  better  manage  stock 
and  lead  times  on  orders. 

Laughlin  met  with  ProfitLogic  in  January. 
For  J.P.  Morgan  Partners,  it’s  another  poten¬ 
tial  match  accomplished.  E3I3 


Kim  Girard  ( kimgirard@sbcglobal.net )  is  a  freelance 
writer  based  in  San  Francisco.  Send  your  comments 
on  this  topic  to  letters@cio.com. 
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Can  your  network 
chase  off  hackers? 


AT&T  NETWORK  SECURITY  PORTFOLIO.  Can  your  network  drive  hackers  crazy?  Can  it  keep  your  data 
accessible  24/7  to  the  people  who  need  it,  while  building  a  brick  wall  in  front  of  those  who  don’t?  AT&T 
delivers  a  broad  portfolio  of  integrated  network  security  solutions  backed  by  experts  that  assess,  monitor, 
detect  and  resolve  security  issues  before  they  become  security  breaches.  It’s  just  what  you’d  expect  from 
the  networking  company  that  carries  more  Internet  traffic  than  anyone  else  in  North  America.  In  fact,  every 
day,  our  networks  repel  thousands  of  hackers  and  send  them  back  to  the  video  arcades  from  which  they 
came.  CAN  YOUR  NETWORK  DO  THIS?  For  a  positive  answer,  just  call  1-888-889-0234. 
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At  any  given  moment,  your 
operations  are  vulnerable  to 
attacks.  Hackers,  viruses  and 
intrusions  can  wreak  havoc  on 
your  network  and  can  disrupt 
and  cripple  key  business 
processes  and  assets  -  costing 
your  business  time  and  money. 


AT&T’s  security  solutions  do  a  number 
on  hackers,  viruses  and  intrusions 
so  they  don’t  do  one  on  you 


AT&T  delivers  a  powerful  suite  of  integrated  security  solutions  that  can  assess 
vulnerabilities,  protect  against  unauthorized  access,  proactively  detect  attacks, 
and  rapidly  respond  to  suspicious  activities  or  events.  It’s  like  a  virtual  security 
guard  to  help  protect  your  network  from  unwanted  intruders. 


AT&T  can  recommend  and 
provide  security  measures 
that  help  prevent  intruders 
from  compromising  your 
networks,  servers,  information 
and  applications  -  protecting 
your  business  by  strengthening 
the  availability  of  your  IT  and 
networking  environment. 

Now  that’s  keeping  your 
business  secure. 

•  The  fully  managed  security 
solutions  provide  simplified 
design,  deployment  and 
management. 

•  Completely  tailored  to  meet 
your  business  security  needs. 


AT&T’s  Network  Security  Portfolio  offers  a  broad  array  of  services  that  include: 

•  Intrusion  detection  and  firewall  services 

•  Token  and  Public  Key  Infrastructure  (PKI)  authentication 

•  Network  scanning  services 

And  coupled  with  AT&T's  professional  networking  expertise  in  the  area  of  ethical 
hacking,  policy  development  and  assessment  services  for  a  secure  solution. 
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•  Offers  significant  savings  in 
capital  and  operating  costs 
verses  a  self-managed 
solution. 

•  Provides  expert  security 
networking  and  24x7 
network  monitoring. 


•  AT&T  [Managed  Security  Services]  was  awarded  the  Customer  Solutions 
Excellence  Award  -  "For  implementing  extremely  flexible  management 
offerings,  being  the  first  to  bring  application  security  services  to  the 
market,  and  offering  the  widest  array  of  services  in  the  industry,  AT&T 
[Managed  Security  Services]  is  awarded  the  Customer  Solutions 
Excellence  Award.”  -  Frost  &  Sullivan,  July  2003 


For  more  information,  contact  your  AT&T 
Representative,  or  visit  www.att.com/networking. 
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anagers  are  under  intense  pressure 

to  create  value.  But  value  creation  by 
improving  operational  efficiency- 
through  such  initiatives  as  outsourcing, 
business  process  reengineering  and  work¬ 
force  reduction— has  limits  in  terms  of 
morale  and  potential.  Companies  must 
couple  such  efficiencies  with  innovation 
and  new  business  development.  Internally 
generated  profitable  growth  is  at  a  pre¬ 
mium.  Even  the  best  companies  have 
struggled  to  create  new  markets  or  sus¬ 
tain  a  high  rate  of  commercially  success¬ 
ful  innovations.  C.K.  Prahalad,  professor 
of  business  administration,  and  Venkat 
Ramaswamy,  professor  of  marketing,  both 
at  the  Michigan  Business  School,  contend 
in  their  new  book,  The  Future  of  Competi¬ 
tion,  that  companies  need  not  (and  should 
not)  go  it  alone  when  trying  to  create 
value.  Their  research  suggests  an  emerg¬ 
ing  economic  model  of  value  cocreation, 
in  which  consumers  and  companies  rou¬ 
tinely  collaborate  to  create  value  that,  to  a 
large  extent,  is  personalized  to  the  individ¬ 
ual.  This  excerpt  explains  that  concept. 

Variety  Does  Not 
Equal  Value 

A  profound  (but  silent)  transformation 
of  our  society  is  afoot.  Our  industrial 
system  is  generating  more  goods  and 
services  than  at  any  point  in  history,  delivered 
through  an  ever-growing  number  of  channels. 
Superstores,  boutiques,  online  retailers  and 
discount  stores  proliferate,  offering  thousands 
of  distinct  products  and  services.  This  prod¬ 
uct  variety  is  overwhelming  to  consumers.  Am 
I  buying  the  right  digital  camera  ?  Am  I  getting 
the  best  treatment  for  my  chronic  ulcer?  Am  I 
signing  up  for  the  right  service?  Simultane¬ 


ously,  thanks  to  the  propagation  of  cell 
phones,  websites  and  media  channels,  con¬ 
sumers  have  increased  access  to  more  infor¬ 
mation,  at  greater  speed  and  lower  cost,  than 
ever  before.  But  who  has  the  leisure  and  the 
proficiency  needed  to  sort  through  and  evalu¬ 
ate  all  these  products  and  services?  The  bur¬ 
geoning  complexity  of  offerings,  as  well  as  the 
associated  risks  and  rewards,  confound  and 
frustrate  most  time-starved  consumers.  Prod¬ 
uct  variety  has  not  necessarily  resulted  in  bet¬ 
ter  consumer  experiences. 

For  senior  management,  the  situation  is  no 
better.  Advances  in  digitization,  biotechnol¬ 
ogy  and  smart  materials  are  increasing  oppor¬ 
tunities  to  create  fundamentally  new  products 
and  services  and  transform  businesses.  Major 
discontinuities  in  the  competitive  landscape — 
ubiquitous  connectivity,  globalization,  indus¬ 
try  deregulation  and  technology  convergence 
— are  blurring  industry  boundaries  and  prod¬ 
uct  definitions.  These  discontinuities  are 
releasing  worldwide  flows  of  information, 
capital,  products  and  ideas,  allowing  nontra- 
ditional  competitors  to  upend  the  status  quo. 
At  the  same  time,  competition  is  intensifying 
and  profit  margins  are  shrinking.  Managers 
can  no  longer  focus  solely  on  costs,  product 
and  process  quality,  speed,  and  efficiency.  For 
profitable  growth,  managers  must  also  strive 
for  new  sources  of  innovation  and  creativity. 

Thus,  the  paradox  of  the  2 1  st-century  econ¬ 
omy:  Consumers  have  more  choices  that  yield 
less  satisfaction.  Top  management  has  more 
strategic  options  that  yield  less  value.  Are  we 
on  the  cusp  of  a  new  industrial  system  with 
traits  different  from  those  we  take  for  granted  ? 

The  emerging  reality  forces  us  to  reexamine 
the  traditional  system  of  company-centric  value 
creation  that  has  served  us  so  well  over  the  past 
100  years.  We  now  need  a  new  frame  of  refer¬ 
ence  for  value  creation.  The  answer;  we  believe, 
lies  in  a  different  premise  centered  on  cocre¬ 
ation  of  value.  It  begins  with  the  changing  role 
of  the  consumer  in  the  industrial  system. 


The  Power  of  the 
Connected  Consumer 

he  most  basic  change  has  been  a  shift 
in  the  role  of  the  consumer — from  iso¬ 
lated  to  connected,  from  unaware  to 
informed,  from  passive  to  active.  The  impact 
of  the  connected,  informed  and  active  con¬ 
sumer  is  manifest  in  many  ways.  Let  us  exam¬ 
ine  some  of  them. 

Information  Access  With  access  to  unprece¬ 
dented  amounts  of  information,  knowledge¬ 
able  consumers  can  make  more  informed 
decisions.  For  companies  accustomed  to 
restricting  the  flow  of  information  to  con¬ 
sumers,  this  shift  is  radical.  Millions  of  net¬ 
worked  consumers  are  now  collectively 

Reader  ROI 

►  A  new  framework  for  creating 
value  for  a  company 

►  Why  consumers  are  now  active 
cocreators  of  value 

►  How  managers  should  respond 
to  the  value  paradigm  shift 

challenging  the  traditions  of  industries  as  var¬ 
ied  as  entertainment,  financial  services  and 
health  care. 

For  instance,  active  health-care  consumers 
(no  longer  the  passive  recipients  of  treatment, 
a.k.a.  patients)  are  using  the  Internet  to  learn 
about  diseases  and  treatments;  the  track 
records  of  doctors,  hospitals  and  clinics;  and 
the  latest  clinical  drug  trials  and  experimen¬ 
tal  procedures — and  to  share  their  personal 
experiences  with  others.  Consumers  can  now 
question  their  physicians  more  aggressively 
and  participate  more  fully  in  their  own  treat¬ 
ment  modalities. 

Global  View  Consumers  can  also  access 
information  on  businesses,  products,  tech¬ 
nologies,  performance,  prices  and  consumer 
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actions  and  reactions  from  around  the  world. 
Twenty  years  ago,  the  two  car  dealerships 
(General  Motors  and  Ford)  in  small  towns  in 
North  America  would  probably  have  influ¬ 
enced  the  driving  aspirations  of  a  local 
teenager.  Today,  a  teen  anywhere  can  dream 
about  owning  one  of  more  than  700  car  mod¬ 
els  listed  on  the  Internet,  creating  a  serious  gap 
between  what  is  immediately  available  in  the 
neighborhood  and  what  is  most  desirable. 

Geographical  limits  on  information  still 
exist,  but  they  are  eroding  fast,  changing  the 
rules  of  business  competition.  For  example, 
broader  consumer  scrutiny  of  product  range, 
price  and  performance  across  geographic  bor¬ 
ders  is  limiting  multinational  companies’  free¬ 
dom  to  vary  the  price  or  quality  of  products 
from  one  location  to  another. 

Networking  Human  beings  have  a  natural 
desire  to  coalesce  around  common  interests, 
needs  and  experiences.  The  explosion  of  the 
Internet  and  advances  in  messaging  and 
telephony — the  number  of  mobile  phone 
users  is  already  over  one  billion — is  fueling 
this  desire,  creating  an  unparalleled  ease  and 
openness  of  communication  among  con¬ 
sumers.  Consequently,  “thematic  consumer 
communities,”  in  which  individuals  share 
ideas  and  feelings  without  regard  for  geo¬ 
graphic  or  social  barriers,  are  revolutionizing 
emerging  markets  and  transforming  estab¬ 
lished  ones. 

The  power  of  consumer  communities 
comes  from  their  independence  from  the 
company.  In  the  pharmaceutical  industry,  for 
instance,  word  of  mouth  about  actual  con¬ 
sumer  experiences  with  a  drug,  and  not  its 
claimed  benefits,  is  increasingly  affecting 
patient  demands.  Thus,  consumer  network¬ 
ing  inverts  the  traditional  top-down  pattern 
of  marketing  communications. 

Experimentation  Consumers  can  also  use 
the  Internet  to  experiment  with  and  develop 
products,  especially  digital  ones.  Consider 
MP3,  the  compression  standard  for  encoding 
digital  audio  developed  by  a  student,  Karl¬ 
heinz  Brandenburg,  and  released  to  the  public 
by  the  Fraunhofer  Institute  in  Germany.  Once 
technology-savvy  consumers  began  experi¬ 
menting  with  MP3,  a  veritable  audio-file- 


sharing  movement  surged  to  challenge  the 
music  industry.  The  collective  genius  of  soft¬ 
ware  users  the  world  over  has  similarly 
enabled  the  codevelopment  of  such  popular 
products  as  the  Apache  Web  server  software 
and  the  Linux  operating  system. 

Of  course,  the  Internet  facilitates  consumer 
sharing  in  nondigital  spheres  as  well:  Aspiring 
chefs  swap  recipes,  gardening  enthusiasts  share 
tips  on  growing  organic  vegetables,  and  home- 
owners  share  insights  into  home  improve- 
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ments.  More  crucial,  consumer  networks 
allow  proxy  experimentation — that  is,  learn¬ 
ing  from  the  experiences  of  others.  The  diver¬ 
sity  of  informed  consumers  around  the  world 
creates  a  wide  base  of  skills,  sophistication  and 
interests  that  any  individual  can  tap  into. 

Activism  As  people  learn,  they  can  better 
discriminate  when  making  choices;  and,  as 
they  network,  they  embolden  each  other  to 
act  and  speak  out.  Consumers  increasingly 
provide  unsolicited  feedback  to  companies 
and  to  each  other.  Already,  hundreds  of  web¬ 
sites  are  perpetuating  consumer  activism, 
many  targeting  specific  companies  and 
brands.  America  Online’s  AOL  Watch,  for 
example,  posts  complaints  from  former  and 


current  AOL  customers.  Blogs  (Web  logs), 
which  present  an  individual’s  worldview 
through  texts,  images  and  Web  links,  facili¬ 
tate  public  expression  and  debate. 

The  Web  has  also  become  a  powerful  tool 
by  which  groups  focused  on  issues  such  as 
child  labor  and  environmental  protection  seek 
corporate  and  governmental  attention  and 
promote  reforms.  Consumer  advocacy 
through  online  groups  may  have  an  even 
greater  impact  than  company  marketing. 
When  Novartis  AG  launched  clinical  trials  of 
a  promising  leukemia  drug,  Gleevec,  word 
spread  so  fast  on  the  Internet  that  the  com¬ 
pany  was  inundated  by  demand  from  patients 
wanting  to  participate.  Activism  by  leukemia 
patients  who  were  on  the  early  clinical  trials 
for  this  drug  led  to  a  highly  effective  lobbying 
effort  via  Internet  support  groups  to  speed  up 
its  production  and  even  get  the  Food  and  Drug 
Administration  to  expedite  its  approval. 

What  is  the  net  result  of  the  changing  role  of 
consumers?  Companies  can  no  longer  act 
autonomously — designing  products,  envelop¬ 
ing  production  processes,  crafting  marketing 
messages  and  controlling  sales  channels — with 
little  or  no  interference  from  consumers.  Con¬ 
sumers  now  seek  to  exercise  their  influence  in 
every  part  of  the  business  system.  Armed  with 
new  tools  and  dissatisfied  with  available 
choices,  consumers  want  to  interact  with  firms 
and  thereby  cocreate  value.  The  use  of  interac¬ 
tion  as  a  basis  for  cocreation  is  at  the  crux  of 
our  emerging  reality. 

Consumer-Company 
Interactions:  Smashing 
Assumptions 

Consider  the  evolution  of  the  health¬ 
care  industry.  Innovations  in  pharma¬ 
ceuticals,  biotechnology,  nutrition, 
cosmetics  and  alternative  therapies  are  creating 
various  treatment  modalities  and  transform¬ 
ing  our  concepts  of  health.  As  both  consumers 
and  technologies  advance,  traditional  medi¬ 
cine  (curing  sickness),  preventive  medicine  and 
improvements  in  the  quality  of  life  are  rapidly 
merging  into  a  “wellness  space.  ”  Let  us  exam¬ 
ine  the  changing  dynamics  of  interaction 
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between  a  consumer  and  the  organizations 
that  participate  in  the  wellness  space. 

Twenty  years  ago,  when  I  was  feeling  ill  and 
visited  my  doctor,  I  might  have  undergone  a 
battery  of  tests  that  would  have  informed  my 
doctor’s  diagnosis,  which  he  would  explain  to 
me  only  if  he  had  to.  He  would  then  choose  a 
treatment  modality,  prescribe  some  medica¬ 
tions  and  schedule  a  follow-up  examination. 
Health  care  back  then  was  generally  doctor¬ 
centric,  just  as  commerce  was  company-cen¬ 
tric.  Doctors  thought  that  they  knew  how  to 
treat  me,  and  since  I  wasn’t  a  physician  myself, 
I  probably  agreed.  Similarly,  most  businesses 
figured  that  they  knew  how  to  create  customer 
value — and  most  customers  agreed. 

Now,  the  health-care  process  is  far  more 
complex.  As  soon  as  I  feel  ill,  I  can  tap  into  the 
expertise  and  experience  of  other  patients  and 
health-care  professionals.  I  can  access  an  abun¬ 
dance  of  information,  some  of  it  reliable,  some 
not.  I  can  investigate  alternative  treatments  for 
any  condition  and  develop  an  opinion  about 
what  might  and  might  not  work  for  me. 

Ultimately,  I  can  cut  my  own  path  through 
the  wellness  space,  thereby  constructing  a  per¬ 
sonal  wellness  portfolio.  If  I’m  grappling  with 
high  cholesterol,  then  I  can  include  pharma¬ 
ceuticals  for  blood  pressure  and  cholesterol 
approved  by  the  IDA,  health  supplements  not 
approved  by  the  FDA,  a  fitness  regimen  devel¬ 
oped  with  an  instructor  and  genetic  screening 
for  hereditary  heart  disease. 

Notice  that  my  wellness  portfolio  does  not 
fit  neatly  into  any  traditional  industry  classifi¬ 
cation.  Yes,  I  visit  my  doctor.  I  get  tests  and 
medications  and  submit  the  bills  to  my  med¬ 
ical  insurance,  provided  through  my  employer. 
But  other  services  in  my  wellness  portfolio  fall 
outside  the  conventional  doctor-based  health 
care,  pharmaceutical  or  insurance  industries. 
My  wellness  space  springs  from  my  view  of 
wellness,  my  biases,  values,  expertise,  prefer¬ 
ences,  expectations,  experiences  and  financial 
wherewithal.  My  spouse,  meanwhile,  can  con¬ 
struct  her  own  wellness  portfolio. 

Rather  than  rely  solely  on  my  doctors’ 
expertise,  I  can  seek  experts  among  my 
peers — other  health-care  consumers — organ¬ 
ized  into  thematic  communities,  such  as  a 


high-cholesterol  group.  This  networked 
knowledge  encompasses  not  just  the  medical 
aspects  pertinent  to  my  condition  but  its  soci¬ 
ology,  psychology  and  likely  impact  on  me, 
my  family  and  the  community  at  large. 

These  consumer-company  interactions  in 
the  wellness  space  fundamentally  challenge 
two  deeply  embedded,  traditional  business 
assumptions:  1.  that  any  given  company  or 
industry  can  create  value  unilaterally;  and  2. 
that  value  resides  exclusively  in  the  company’s 
or  industry’s  products  and  services.  What  new 
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concepts  do  we  need  to  understand  the  impli¬ 
cations  of  the  emerging  pattern  of  interactions 
between  consumers  and  the  company? 


Cocreation  in  Action 

Let  us  stay  in  the  medical  field  and  look 
at  cardiac  pacemakers,  which  we 
believe  is  a  prototype  of  the  emerging 
process  of  value  creation.  Millions  of  adults 
in  the  United  States  suffer  from  various  car¬ 
diac  maladies.  Many  of  them  could  get  a  pace¬ 
maker  that  monitors  and  manages  their  heart 
rhythm  and  performance,  a  valuable  benefit. 
However,  a  patient’s  comfort  level  would 
increase  substantially  if  someone  or  some¬ 
thing  monitored  his  heart  remotely  and 
alerted  him  and  his  doctor  simultaneously  of 


any  deviations  from  a  predetermined  band¬ 
width  of  performance  relevant  to  his  condi¬ 
tion.  Doctor  and  patient  together  could  decide 
on  the  remedial  response. 

The  scenario  gets  more  complicated  when 
the  patient  travels  far  from  home.  A  mere  alert 
will  not  suffice.  The  patient  needs  directions  to 
the  best  nearby  hospital,  and  the  attending 
physician  needs  access  to  the  patient’s  medical 
history.  How  do  the  two  doctors — the 
patient’s  primary  care  provider  back  home 
and  the  physician  on  call  at  the  out-of-town 
hospital — coordinate  their  diagnosis  and 
treatment?  Should  the  patient  call  his  spouse? 
How  can  the  patient  recognize  and  assess  the 
risks  and  develop  an  approach  to  compliance 
and  cooperation  with  these  medical  profes¬ 
sionals?  Are  the  doctors,  the  facilities  and  serv¬ 
ices,  and  the  pacemaker  all  part  of  a  network 
centered  on  the  patient  and  his  well-being? 

Companies  are  already  installing  elements 
of  these  network  capabilities.  Consider 
Medtronic  Inc.,  a  world  leader  in  cardiac 
rhythm  management  that  seeks  to  offer  life¬ 
long  solutions  for  patients  with  chronic  heart 
disease.  It  has  developed  a  system  of  “virtual 
office  visits”  that  enables  physicians  to  check 
patients’  implanted  cardiac  devices  via  the 
Internet.  With  the  Medtronic  CareLink  Mon¬ 
itor,  the  patient  can  collect  data  by  holding  a 
small  antenna  over  his  implanted  device.  The 
data  is  captured  by  the  antenna,  downloaded 
by  the  monitor  and  transmitted  by  a  standard 
telephone  line  to  the  Medtronic  CareLink 
Network.  On  a  dedicated  secure  website, 
physicians  can  review  patient  data  and 
patients  can  check  on  their  own  conditions — 
but  no  one  else’s — and  grant  access  to  family 
members  or  other  caregivers. 

Medtronic’s  CareLink  system  goes  beyond 
the  cardiac  device  itself  and  unleashes  oppor¬ 
tunities  for  an  expanding  range  of  value-cre¬ 
ation  activities.  For  example,  each  person’s 
heart  responds  to  stimulation  slightly  differ¬ 
ently,  and  the  response  can  change  over  time. 
In  the  future,  doctors  will  be  able  to  respond 
to  such  changes  by  adjusting  the  patient’s  pace¬ 
maker  remotely.  Furthermore,  Medtronic’s 
technology  platform  can  support  a  wide  range 
of  devices  and  remote  monitoring/diagnostic 
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Book  Excerpt  |  The  Future  of  Competition 


systems,  potentially  used  for  monitoring  blood 
sugar  readings,  brain  activity,  blood  pressure 
and  other  important  physiological  measures. 

Now,  as  a  manager,  consider  the  following 
questions: 

1.  How  does  the  patient  actively  participate 
in  the  process  of  cocreating  value? 

2.  How  does  the  quality  of  the  patient’s  inter¬ 
actions  with  the  doctor,  the  family  and  the  staff 
of  the  out-of-town  hospital  affect  the  quality 
of  the  patient’s  overall  experience? 

3.  What  is  the  basis  of  value  creation  here? 
What  role  does  the  total  network  of  related 
products,  services  and  caregivers  play  in  cre¬ 
ating  value?  How  can  any  one  of  them  create 
unique  value  with  the  patient  at  any  given 
point  in  time?  What  if  the  patient  values  the 
whole  experience  cocreated  with  the  network, 
and  not  simply  with  the  pacemaker? 

4.  How  does  the  network’s  ability  to  accom¬ 
modate  different  situations  affect  the  patient 
experience — different  time  and  location  of  the 
event  of  an  irregular  heartbeat?  Can  the  same 
individual  have  a  different  experience  with  the 
network  under  different  circumstances, 
depending  on  the  context  of  the  event  and  his 
personal  preferences  at  that  moment  in  time? 

5.  Can  companies  create  an  environment 
that  generates  experience  variety  without  bur¬ 
dening  the  consumer  with  a  variety  of  prod¬ 
ucts  and  services? 

The  pacemaker  story  illustrates  the  new 
value  creation  space:  A  competitive  space  cen¬ 
tered  on  personalized  cocreation  experiences 
developed  through  purposeful  interactions 
between  the  consumer  and  a  network  of  com¬ 
panies  and  consumer  communities. 

Value  does  not  stem  from  the  physical 
product  (the  pacemaker),  or  from  the  com¬ 
munications  and  IT  network  that  supports  the 
system,  and  not  even  from  the  social  and  skill 
network  that  includes  doctors,  hospitals,  the 
family  and  the  broader  consumer  community. 
Value  lies  in  the  cocreation  experience  of  a  spe¬ 
cific  patient,  at  a  specific  point  in  time,  in  a  spe¬ 
cific  location,  in  the  context  of  a  specific  event. 

The  cocreation  experience  cannot  occur 
without  a  network  of  firms  collaborating  to 
create  the  environment  that  allows  the  patient 
to  undergo  that  unique  cocreation  experience. 


The  network,  not  owned  by  any  single  firm, 
multiplies  the  value  of  the  pacemaker  to  the 
patient,  his  family  and  his  doctors.  The  patient, 
by  cocreating  with  the  network,  is  an  active 
stakeholder  in  defining  the  interaction  and  the 
context  of  the  event.  The  total  cocreation  expe¬ 
rience  with  the  network  results  in  value  that  is 
more  personal  and  unique  for  each  individual. 

To  see  and  take  advantage  of  these  oppor¬ 
tunities,  we  must  suspend  the  traditional  dis¬ 
tinction  between  B2B  and  B2C  customers.  In 
the  world  of  cocreation,  we  have  to  imagine 
every  individual  who  interacts  with  the  com¬ 
pany  as  a  “consumer,”  whether  that  individ¬ 
ual  is  a  forklift  operator,  a  pilot,  a  design 


Managers 

must  attend 
to  the  quality 
of  cocreation 
experiences, 
not  just  to  the 
quality  of  the 
firm’s  prod¬ 
ucts  and 
processes. 

engineer,  a  beautician,  a  clinical  researcher,  an 
instructor,  a  contractor,  a  paralegal  or  a  civic 
worker.  This  perspective  forces  us  to  discard 
the  artificial  distinctions  among  enterprises 
and  households.  Furthermore,  historically  we 
have  started  with  “B” — our  business — and 
not  the  individual  consumer.  This  company- 


Share  Your  Opinion 


Prahalad  and  Ramaswamy  suggest  that  future 
value  will  come  from  enabling  customers  to 
participate  in  value  creation.  Do  you  agree? 

Is  that  IT’s  future?  Scroll  to  the  bottom  of  the 
online  version  of  this  story  and  ADD  A 
COMMENT. 

cio.com 


centric  view  of  value  creation  is  deep-rooted, 
as  it  has  been  the  very  foundation  of  competi¬ 
tion  in  the  industrial  era. 

The  New  Frame 
of  Reference 

f  the  consumer  and  the  firm  cocreate  value, 
then  the  cocreation  experience  becomes  the 
very  basis  of  value.  This  suggests  new  capa¬ 
bilities  for  firms.  Managers  must  attend  to  the 
quality  of  cocreation  experiences,  not  just  to 
the  quality  of  the  firm’s  products  and 
processes.  Quality  depends  on  the  infrastruc¬ 
ture  for  interaction  between  companies  and 
consumers,  oriented  around  the  capacity  to 
create  a  variety  of  experiences.  The  firm  must 
efficiently  innovate  “experience  environ¬ 
ments”  that  enable  a  diversity  of  cocreation 
experiences.  It  must  build  a  flexible  “experi¬ 
ence  network”  that  allows  individuals  to 
coconstruct  and  personalize  their  experiences. 
Eventually,  the  roles  of  the  company  and  the 
consumer  converge  toward  a  unique  cocre¬ 
ation  experience,  or  an  “experience  of  one.” 

Notice  what  cocreation  is  not.  It  is  neither 
the  transfer  nor  outsourcing  of  activities  to 
customers,  nor  a  marginal  customization  of 
products  and  services.  Nor  is  it  a  scripting  or 
staging  of  customer  events  around  the  firm’s 
various  offerings.  That  kind  of  company-cus¬ 
tomer  interaction  no  longer  satisfies  most  con¬ 
sumers  today. 

The  change  that  we  are  describing  is  far 
more  fundamental.  It  involves  the  cocreation 
of  value  through  personalized  interactions 
that  are  meaningful  and  sensitive  to  a  specific 
consumer.  The  cocreation  experience  (not 
the  offering)  is  the  basis  of  unique  value  for 
each  individual.  The  market  begins  to  resem¬ 
ble  a  forum  organized  around  individuals 
and  their  cocreation  experiences  rather  than 
around  passive  pockets  of  demand  for  the 
firm’s  offerings. 

Recognizing  that  the  traditional  system  is 
becoming  obsolete,  many  firms  are  already 
testing  new  business  assumptions,  preparing 
to  compete  on  the  basis  of  those  personalized 
cocreation  experiences  that  result  in  value 
truly  unique  to  each  individual.  HEJ 
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Uncertain  times  favor  agile  organizations.  Learn  how  to  become  one. 


Agility  helps  ensure  that 
businesses  and  organiza¬ 
tions  survive  -  and  thrive  -  by 
being  able  to  respond  quickly 
to  changing  business  condi¬ 
tions,  and  being  able  to  spot 
and  take  advantage  of  new 
opportunities  before  the 
competition. 

Agile  IT  organizations  are 
those  that  are  ready  to  meet 
the  business  challenges  with 
flexible  staffing  models  and 


sourcing  strategies,  modular 
architecture  and  open-ended 
technology,  along  with  nimble 
governance  and  project  priori¬ 
tization  and  management 
structures.  This  year’s  CIO  100 
winners  exemplify  leadership 
and  innovation  in  the  use  of  IT 
to  give  their  companies  an 
edge  in  an  environment  where 
the  only  constants  are  change 
and  uncertainty. 


We’ll  talk  to  CIOs  who  have: 

>  Implemented  systems  and 
practices  that  bring  them 
closer  to  customers,  eliminate 
waste  and  drive  relentless 
improvement  to  ensure  lean 
business  practices. 

>  Adopted  world  class  tools 
and  methodologies  to  improve 
service  delivery,  reduce  costs 
and  increase  flexibility. 

>  Demonstrated  processes  and 
flat  staffing  that  enable  them 


to  quickly  and  efficiently  scale 
staff  to  meet  changing  busi¬ 
ness  demands. 

>  Synchronized  business  and 
IT  to  capitalize  on  change, 
while  designing  a  robust  and 
adaptive  infrastructure  to 
accept  frequent  and  substan¬ 
tial  change  without  impacting 
service  level  agreements. 

>  Significantly  contributed  to  a 
growth  in  market  leadership  by 
using  IT  support  to  facilitate 
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or  visit  us  at 

www.cio.com/conferences 
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Leadership  and  innovation  have  many  guises. 

Expose  yourself  io  new  ideas  and  approaches. 

Symposium  moderator  Paul  Saffo,  Director  of  the  Institute  for  the  Future,  returns  this  year  to 
propose  more  provocative  scenarios  and  inspire  spirited  discussions.  Saffo  takes  a  look  at 
what  current  trends  not  only  pose  the  most  problems  for  CIOs,  but  those  that  could  provide 
great  opportunity. 


Michael  Hawley,  Director  of  Special  Projects  at  MIT,  has  accomplished  many  amazing  things 
himself  -  named  as  one  of  the  most  creative  individuals  in  America  in  2001,  won  the  Van 
Cliburn  piano  competition  in  2002,  did  pioneering  work  in  digital  cinema  at  Lucasfilm, 
deployed  technology  for  the  1998  American  Everest  Expedition,  and  recently  published  the 
world’s  largest  book  of  photographs,  BHUTAN.  Hawley  says,  above  all,  he  is  proudest  of  his 
students,  who  have  in  turn  gone  on  to  accomplish  their  own  amazing  things.  He  shares  insights 
on  his  own  style  of  leadership,  inspiring  innovation  and  applying  technology  to  benefit  business 
and  humanity. 


the  delivery  of  new  business 
models. 

>  Developed  an  asset  manage¬ 
ment  initiative  to  quickly  and 
effectively  prioritize  efforts 
around  protecting  critical  tech¬ 
nology  assets  and  stand  ready 

1  for  IT  security  threats. 

>  Championed  the  IT  department 
as  pro-active,  knowledgeable 
business  partners. 
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the  best  peer-to-peer  networking. 

Spend  quality  time  with  other  CIOs. 

SUNDAY  CIO  Executive  Mindshare  Meetings  are  hosted  by  CIO 
magazine  editors  and  practicing  CIOs.  Each  group  examines  a 
specific  IT  pain  point  and  comes  away  with  ideas  for  solutions. 

MONDAY  AND  TUESDAY  Lunch  Roundtables  explore  current 
business  and  industry  trends,  with  topics  suggested  by  our  CIO 
advisors. 

TUESDAY  Informal  Breakfast  Discussions  focus  on  technologies 
and  experiences  in  implementing  major  initiatives. 

And  you  meet  more  CIO  peers  during  the  golf  tournament, 
refreshment  breaks,  nightly  receptions  and  special  hospitalities. 


Small  group  discussions  make  for 
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A  Cold  Look  at  Hot  Trends 


AH  Work  and 

No  Play 

Americans  have  stopped  taking  vacations.  And  that’s 
bad  for  business.  Not  the  travel  business;  their  own. 

BY  MEGAN  SANTOSUS 

I’D  BE  THE  FIRST  to  tell  you  that  maternity  leave — even  a  generous  one 
spanning  a  few  months — is  no  day  at  the  beach. 

I’ve  had  three  of  them,  and  it’s  an  existence  lived  between  a 
nap  and  a  nap,  cramming  into  two-hour  chunks  feedings,  dia¬ 
pers  and  laundry.  Lots  of  laundry.  It’s  also  3  a.m.  jaunts  on  the 
treadmill  in  a  dual  attempt  to  put  that  baby  strapped  to  your 
body  to  sleep  while  shedding  those  excess  pounds.  And  in  your 
most  vulnerable  moments,  it’s  regretting  the  fact  that  you  put 
your  name  on  the  Do  Not  Call  list,  because  the  adult  interac¬ 
tion  afforded  by  telemarketers  is  suddenly  a  welcome  diver¬ 
sion  from  maternal  bliss. 

But  I  will  say  one  thing  about  maternity  leave:  It’s  a  nice 
break  from  work,  the  kind  of  break  that’s  increasingly  rare. 
When  you’re  on  leave  caring  for  a  newborn,  no  one  expects  you 
to  check  in  via  phone  or  e-mail.  Since  the  only  clothing  you  can 
wear  are  sweats,  you  have  another  excuse  for  staying  home.  In 
short,  you  can  enjoy  weeks  without  deadlines,  office  politics, 
schedules  and  routines — all  that  stuff  that  equals  your  life  on 
the  job.  And  take  it  from  someone  who’s  been  there,  those 
unencumbered  weeks  offer  a  new  and  refreshing  perspective 
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on  work.  For  one  thing,  I  no  longer  take  it  so  seriously.  Yes, 
boss,  I  remain  committed  to  my  job,  and  I  always  strive  to  do 
good  work.  But  once  I  leave  the  office  at  the  end  of  each  day, 
whether  I  succeed  suddenly  has  less  bearing  on  my  life  and  no 
impact  on  my  ego. 

In  a  world  where  (according  to  the  Families  and  Work  Insti¬ 
tute)  many  Americans  don’t  take  all  of  their  vacation  time,  and 
where  cell  phones  and  laptops  are  packed  before  bathing  suits 
and  sunscreen,  long  spells  away  from  the  office  for  any  reason 
other  than  serious  ill-health  are  unheard  of.  It’s  little  wonder 
that  stress  rates  are  high  and  employees  have  a  burnout  rate 
reminiscent  of  a  Silicon  Valley  dotcom.  It’s  a  vicious  cycle.  With 
recent  layoffs,  the  remaining  employees  work  harder.  The 
harder  they  work,  the  more  they  need  a  break.  But  with  layoffs 
in  their  rearview  mirrors  and  the  fear  of  more  ahead,  the  less 
likely  they  are  to  allow  themselves  to  take  one. 


ILLUSTRATION  BY  ARTHUR  GIRON 
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Business  continuity  and  security  solutions  from  EMC: 
Building  confidence  for  the  business. 


We  bring  you  ironclad  choices  for  making  your  organization  safer— and  more  productive.  Take  our  Security 
Analysis  &  Management  System.  You’ll  gain  unmatched  information  sharing,  detection,  and  validation 
capabilities  on  an  open,  modular  architecture  that  lets  you  easily  expand  and  upgrade  to  meet  your  needs. 
It’s  another  way  we  help  you  maximize  the  value  of  information,  at  the  lowest  total  cost  of  ownership,  at 
every  point  in  the  information  lifecycle.  Learn  more  atwww.EMC.com/security. 
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The  Mania  for  Work 

Needless  to  say,  an  environment  that  emphasizes  work  without 
play  is  unhealthy.  And  anything  that’s  unhealthy  has  to  be  bad 
for  business  in  the  long  run. 

As  founder  and  CEO  of  outplacement  consultancy  Chal¬ 
lenger,  Gray  &  Christmas,  John  Challenger  makes  it  his  busi¬ 
ness  to  stay  on  top  of  workplace  trends,  and  he  sees  a  real 
danger  in  our  culture  of  endless,  pervasive  work.  “This  has 
happened  before  in  the  tech  industry.  People  burn  out,”  Chal¬ 
lenger  says.  And  if  the  number  of  jobs  available  begins  to 
increase,  burnout  will  lead  to  turnover,  something  few  compa¬ 
nies  would  welcome  during  a  business  upswing.  “No  company 


can  afford  to  lose  its  best  people  by  running  them  so  hard  they 
ultimately  move  on  to  other  places,”  Challenger  says.  As  the 
economy  grows,  companies  will  need  to  focus  much  of  their 
attention  on  retaining  employees.  “That  means  giving  them 
room  to  breathe,”  he  says. 

It  would  be  great  if  that  breathing  room  included  more  than 
the  typical  few  weeks  of  paid  vacation.  My  recent  four-month 
“break”  was  just  the  right  amount  of  time  I  needed  to  decom¬ 
press,  to  shift  my  mental  and  physical  energies  away  from  the 
world  of  work.  True,  I  wouldn’t  classify  my  maternity  leave 
as  downtime  (I  read  a  grand  total  of  one  book  for  fun),  but 
when  I  returned  to  work  I  felt  reenergized  simply  because  I 
had  experienced  some  sustained  relief  from  the  inherent  stress 
involved  in  switching  between  work  and  home.  A  week’s  vaca¬ 
tion  here  and  there  over  the  course  of  the  year  doesn’t  provide 
enough  time  to  allow  your  mind  to  leave  work  behind — par¬ 
ticularly  for  executives  who  can’t  go  to  the  can  without  taking 
their  cell  phones  along  (you  know  who  you  are). 

A  Modest  Proposal 

As  a  nation  of  stressed-out  workaholics,  we  need  to  shift  our 
priorities,  and  be — dare  I  suggest  it? — more  like  the  Europeans, 
who  down  tools  for  weeks  at  a  time  without  seeing  their  lives 
and  economies  fall  apart.  We  should  encourage  sabbaticals 
with  some  sort  of  stipend  that  allows  us  weeks  or  even  months 
away  from  the  office.  During  our  officially  sanctioned  absences, 
we’d  be  free  to  travel,  take  cooking  classes,  write  that  crime 
novel  or  do  anything  as  long  as  it  has  nothing  to  do  with  work. 


If  sabbaticals  are  accepted  as  the  norm,  careers  won’t  suffer. 
We’d  be  more  balanced,  less  harried  and  probably  a  lot  more 
interesting  as  individuals. 

And  what’s  the  chance  that  sabbaticals,  or  something  like 
them,  would  be  accepted  by  corporate  America? 

According  to  Challenger,  it’s  somewhat  less  than  zero. 

He  would  be  happy  if  people  just  started  taking  all  the  vaca¬ 
tion  time  due  to  them.  Yet  even  on  that  score,  he’s  not  opti¬ 
mistic.  When  salaries  are  stagnant,  Challenger  says,  “people 
don’t  really  want  to  spend  the  money  to  go  somewhere.  Sitting 
around  at  home  doesn’t  seem  all  that  attractive,  so  a  lot  of 
people  just  forego  taking  a  vacation.”  And  when  salaries  begin 

to  grow,  there’s  another  reason 
people  find  for  not  taking  vaca¬ 
tions:  They’re  too  stressful.  “You 
keep  checking  in,  your  work 
piles  up,  and  you  have  a  night¬ 
mare  when  you  get  back,”  says 
Challenger. 

Talk  about  nightmares!  It’s 
become  too  hard,  too  scary,  to 
take  a  vacation.  You  leave  the 
beach;  you  go  back  to  your  room;  you  start  thinking  about 
this  project  or  that  meeting.  You  try  to  call  work — and  you 
can’t  get  a  line.  Or  the  person  who’s  covering  for  you  isn’t 
there.  You  try  to  check  your  e-mail,  but  you  can’t  log  on.  And 
you  worry.  Who’s  covering?  What’s  happening?  Hey,  you  might 
as  well  be  in  the  office.  It’s  simpler. 

Challenger  has  seen  the  consequences:  Executives  who  never 
distance  themselves  from  work,  never  have  the  opportunity  to 
recharge  their  batteries. 

Why  not  just  reserve  your  spot  in  the  cardiac  care  unit  now? 

For  employees  to  feel  entitled  to  take  all  their  vacation  time, 
managers  and  executives  have  to  set  an  example.  The  boss 
should  use  up  his  vacation  time  every  year.  Leave  contact  info 
behind,  but  make  sure  people  understand  that  it’s  to  be  used 
only  in  an  emergency. 

Right.  Again,  the  prospects  for  that  happening  seem  dim.  If 
the  boss  can  leave  and  cut  the  tether  for  two  or  three  or  even 
four  weeks,  the  twisted  message,  the  message  he  fears,  may  be 
that  he’s  not  needed. 

The  proper  message,  of  course,  is  that  he’s  done  a  terrific 
job  preparing  his  reports  to  take  over. 

Oh,  well.  In  about  a  year  or  so,  I’ll  be  ready  for  another 
break,  and  it  looks  like  I’ll  have  only  one  way 
to  do  that. 

Oh,  honey?  HPl 


Opinion  and  Knowledge  Management  Editor  Megan 
Santosus  can  be  reached  at  santosus@cio.com. 


In  a  nation  of  stressed-out  workaholics,  we  need  to 
shift  our  priorities,  and  be— dare  I  suggest  it?— more 
like  the  Europeans,  who  down  tools  for  weeks  at  a  time 
without  seeing  their  lives  and  economies  fall  apart. 
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Introducing  Raritan's  Dominion™  Series. 

Because  a  more  efficient  Data  Center  means  a  more  efficient  company. 

Three  months  from  now,  you  could  be  standing  in  front  of  your  company,  saying  "Productivity  is  up  and  costs  are  down."  It's 
no  surprise.  With  Raritan's  newest  additions  to  the  Dominion  Series,  it's  easier  and  more  efficient  to  manage  technology  assets 
anywhere  in  the  world.  Dominion  KX  gives  you  the  industry's  most  dependable  and  most  secure  KVM  over  IP  technology; 
CommandCenter™  provides  consolidated  enterprise  command  and  control.  You'll  have  128-bit  security,  scalability,  in  and 
out-of-band  access,  full  cross-platform  compatibility,  and  more.  Deployed  separately  or  together,  the  Dominion  Series  protects 
your  bottom  line  as  well  as  your  bottom. 


Ask  your  Data  Center  Manager  to  schedule  a  test  drive  by  calling  1-800-724-8090  x938 

or  by  visiting  us  at  www.raritan.com/938 
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CommandCenter, 
for  consolidated  enterprise 
control,  is  one  part  of 
RARITAN'S  DOMINION  SERIES 
The  Complete  Data  Center 
Management  Solution 
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When  you  re  ready  to  take  control 


TM 


Career  Counsel 

Expert  Advice  to  Aspiring  CIOs  and  IT  Managers 


Switching 

Tracks 


Deciding  which  transformations  are  for  you 

and  which  are  against  you. 


Q:  I  am  challenged  with  fostering  a  change  in  the  culture  of  a 
company.  Currently  it  is  very  political  and  competitive.  Are 
there  any  successful  tactics  or  “safe  bets"  for  this  effort  with¬ 
out  having  an  adverse  effect  on  my  career?  I  understand  that 
a  major  change  like  this  may  be  a  road  to  a  C-level  position, 
but  then  again,  it  can  lead  to  the  unemployment  line  too.  Is  it 
worth  the  risk? 

A:  In  leading  change  efforts  around  culture,  there  are  no  safe 
bets.  By  the  nature  of  fostering  change,  you  will  no  doubt 
offend  and  threaten  some  people.  To  attempt  to  minimize 
the  risk  of  losing  your  job,  you  had  best  be  sure  that  several 
senior  executives  who  are  actively  communicating  the 
change  and  are  true  sponsors  and  champions  for  this  are 
backing  you.  Ongoing  meetings  and  perhaps  town-hall 
gatherings  should  be  frequent  enough  to  reinforce  manage¬ 
ment’s  commitment  to  this  change  and  the  benefits  that  will 
be  derived  from  it. 

I  also  suggest  getting  some  organizational  psychologists  or 
the  equivalent  involved  who  can  provide  guidance  and  sup- 
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port  while  the  transformation  is  under  way. 

From  a  behavioral  point  of  view,  by  being  open,  direct  and 
sincere,  and  constantly  communicating  senior  management’s 
vision,  you  will  begin  to  convince  others  of  the  benefits  of 
change.  Winning  over  some  key  constituents  early  on  may  have 
a  ripple  effect,  which  is  what  you  want. 

While  there  is  no  safe  haven  and  you  will  be  taking  a  risk,  you 
will  learn  a  lot  from  this  experience.  And  even  if  it  does  not 
work  out  as  well  as  you  hope,  your  efforts  will  add  to  your 
career  portfolio  and  will  also  look  good  on  your  resume. 
Employers  look  for  risk-takers  and  respect  those  who  have 
strong  convictions  and  work  hard  in  carrying  out  their  mission. 

-Beverly  Lieberman,  president  of  Halbrecht  Lieberman  Associates 
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CIO  ENTERPRISE  VALUE  AWARDS 


Honoring  Business  Achievement  Through 
the  Innovative  Use  of  Information  Technology 

DEADLINE:  MAY  1,  2004 


CIO  ENTERPRISE  VALUE  AWARDS 


Applicants  will  apply 
and  be  honored  within 
their  own  industries. 
Winners  from  each 
industry  category  will 
automatically  be  finalists 
for  the  Grand  CIO 
Enterprise  Value 
Award  for  exceptional 
achievement. 

Download  the  application  at 

www.cio.com/eva 

Deadline  for  entry: 

May  1,2004 


As  a  Winner  You  Will: 

►  Be  featured  in  the  February  15, 2005, 
issue  of  CIO  magazine,  as  well  as  on 
CIO.com. 

►  Attend  the  Enterprise  Value  Retreat, 
where  you  will  exchange  practices  and 
lessons  learned  with  your  fellow 
winners  and  executive  peers. 

►  Be  celebrated  at  a  dinner  and  awards 
ceremony  honoring  those  involved  in 
the  winning  systems’  success. 

►  Be  presented  with  a  beautiful  and 
unique  Enterprise  Value  Award  star- 
each  one  is  a  handcrafted  piece  of 
commissioned  art. 

►  Receive  public  relations  assistance  to 
extend  the  awareness  of  this  award 
with  your  employees,  investors  and 
customer  communities  through 
support  of  CIO  magazine’s  News  and 
Information  team. 

►  Showcase  the  awards  evening  by 
participating  in  a  professional  photo 
shoot  at  the  ceremony. 

►  Enjoy  enhanced  recruiting 
opportunities. 


For  complete  application  instructions,  visit  our  website  at  www.cio.com/evavt 


■Hi 


Criteria 

The  CIO  Enterprise  Value  Awards  honor  technology-enabled  business 
achievement.  Winners  will  be  chosen  from  entrants  who  submit  com¬ 


Entry  Guidelines 

■  The  system  must  have  been  operational 
priorto  April  1,  2003. 


pleted  application  forms  to  CIO  magazine  by  May  1, 2004.  Entries  will 
be  judged  on  the  value  of  the  achievement  resulting  from  the  technol¬ 
ogy  investment  and  the  degree  to  which  it  serves  the  organization's 
mission.  Judges  are  looking  for  initiatives  that  have  had  a  broad  and 
significant  impact  on  the  enterprise  as  a  whole. 

Defining  Value 

We  invite  applicants  to  consider  the  broadest  possible  spectrum  of 
enterprise  value.  The  business  benefits  include  but  are  not  restricted 
to  STRATEGIC,  CUSTOMER,  FINANCIAL,  OPERATIONAL  and  SOCIAL 
impact. 

Selection  Process 

Finalists  are  selected  by  judging  teams  made  up  of  CIO  magazine  edi¬ 
tors  and  CIO  Enterprise  Value  Awards  Review  Board  members 
(respected  academics  and  consultants).  These  teams  conduct  due- 
diligence  interviews  with  finalist  CIOs  and  neutral  third  parties.  Win¬ 
ners  are  selected  based  on  the  value  of  their  initiatives  to  the 
enterprise.  Once  the  judging  teams  have  selected  industry  winners, 
our  Review  Board  will  conduct  additional  interviews  with  business 
sponsors  and  system  supporters.  This  may  include  a  site  visit  to  take 
place  over  the  summer.  The  Review  Board  will  present  its  findings  to 
the  Judges  (a  blue-ribbon  panel  of  leading  CIOs)  for  the  final  selection 
of  the  Grand  CIO  Enterprise  Value  Award  winner. 

How  to  Apply 

Download  the  application  at  www.cio.com/eva.  Questions?  Contact  us 
at  eva@cio.com  or  888-455-4646. 

Important  Dates 

Deadline:  Applications  must  be  received  by  May  1,  2004. 

Notification:  Winners  will  be  notified  in  Summer  2004. 

Presentation:  Awards  ceremony  takes  place  during  the  CIO  Enterprise 
Value  Retreat,  February  6-8,  2005.  Winners  will  be  profiled  in  the 
February  15,  2005,  issue  of  CIO  magazine. 


■  Entries  must  be  made  jointly  by  the  CIO/IT 
executive  sponsor  AND  by  the  business  spon¬ 
sor  for  whom  the  system  delivers  value. 

■  Entrants  must  agree  to  be  featured,  along 
with  their  systems  and  organizations,  in  a 
CIO  article. 

■  IT  vendors,  public  relations  and  advertising 
companies,  consultants  and  other  third  par¬ 
ties  may  NOT  apply  on  behalf  of  another 
company.  They  are  encouraged  to  forward 
the  application  to  the  “owner”  of  the  system. 

■  IT  vendors  may  submit  applications  for  an  IT 
system  that  they  used  internally  to  help  run 
their  businesses  better.  They  may  not  submit 
a  product  or  service  that  they  sell  to  CIOs. 

■  Entrants  will  apply  within  one  of  the  12 
industry  categories. 

1.  Manufacturing  (including  automotive, 
aerospace  &  defense,  construction, 
engineering,  chemicals,  metals  &  mining) 

2.  Banking  and  Brokerage 

3.  Insurance 

4.  Health  Care  (providers  and 
pharmaceuticals) 

5.  Government  (including  military  &  law 
enforcement) 

6.  Nonprofits  (including  education) 

7.  Transportation  (airlines,  trucking, 
railroads,  shipping,  logistics) 

8.  Retail,  Wholesale  and  Distribution 

9.  Management  Services  (legal,  consulting, 
real  estate) 

10.  Media,  Entertainment,  Travel  &  Leisure 
(publishing,  radio,  television,  cruise 
lines,  hotels,  theme  parks,  casinos) 

11.  High  Tech 

12.  Telecom  &  Utilities 


or  contact  us  at  eva@cio.com. 


The  Resource 
for  Information 
Executives 


2005 

CIO  ENTERPRISE  VALUE  AWARDS 


Congratulations  to  Our  2004  Winners! 

Academic  Management  Services  Corp. 

Ace  Hardware  Corp. 

Chicago  Police  Department 
Continental  Airlines  Inc. 

Dell  Inc. 

The  Guardian  Life  Insurance  Company  of  America 
Korn/Ferry  International 
Pfizer  Inc. 

The  Procter  &  Gamble  Co. 

Worldspan  LP 

2004  GRAND  AWARD  WINNER 

Chicago  Police  Department 

To  view  a  list  of  all  previous  winners,  go  to 
www.cio.com/awards/eva/winners.html 


For  More  Information 

Visit  the  awards  website  at  www.cio.com/eva  or 
contact  us  at  eva@cio.com  or  call  888-455-4646. 

Deadline  for  entry:  May  1,  2004 


Presented  by 


The  Resource  for  Information  Executives 


Download  the  application  at  www.cio.com/eva 


CIO  ENTERPRISE 
VALUE  AWARDS' 


The  Resource  for 
Information  Executives 


As  an  executive  who  has  built  or  utilized  an  IT  system  that 
delivers  both  demonstrable  ROI  and  strategic  value  to  your 
organization,  you  deserve  recognition  and  praise. 

Now  in  its  13th  year,  the  CIO  Enterprise  Value  Award  will 
bring  you,  your  company  and  your  IT  organization  the 
industry  prestige  you  deserve. 


Download  the  application 
from  our  website  at 

www.cio.com/eva 

or  contact  Julie  Hanson 
at  508  935-4669. 

Deadline  for  entry: 

May  1,  2004 


Career  Counsel 


CHANGING  YOU 

Q:  I  have  postgraduate  training  in  computer  science  and  have 
13  years  of  widely  mixed  experience  in  software  develop¬ 
ment,  training,  project  management  and  quality  assurance. 
I  also  have  more  than  three  years  of  entrepreneurship  expe¬ 
rience  in  these  fields.  Currently  I  am  working  in  presales  and 
sales-support  for  an  IT  services  organization.  What  are  my 
future  growth  prospects,  and  how  should  I  shape  my  career 
going  forward? 

A:  In  order  to  decide  on  a  direction  for  your  career,  you  need 
to  consider  what  you  enjoy  most  about  the  kind  of  work  you 
have  been  doing  and  the  type  of  work  environment  that  suits 
you  best.  Should  you  continue  on  your  current  track,  one 
option  would  be  to  work  for  a  technology  product  or  serv¬ 
ices  company  to  lead  product  development  initiatives  as  well 
as  marketing  and  business  development.  Positions  that  offer 
the  biggest  financial  rewards  are  often  those  in  sales.  The 
senior-most  roles  in  vendor  organizations  tend  to  be  filled  by 
executives  who  have  marketing  and  customer  management 
backgrounds. 

Another  option  is  to  pursue  management  roles  in  large  cor¬ 
porations.  These  include  leading  large-scale  systems  integration 
projects  such  as  ERP  implementations.  These  are  often  multi¬ 
year  projects  and  can  include  global  responsibilities.  Having 
global  experience  at  a  senior  project  and  management  level  will 
position  your  career  to  be  tracking  a  CIO  role  or  equivalent. 

-B.L. 


CHANGING  YOUR  MIND 

Q:  I  took  a  CIO  position  at  a  smaller  company  because  I 
needed  a  job.  However,  my  heart  is  not  in  it.  As  a  profes¬ 
sional,  I  am  doing  my  best  to  support  the  team  and  the  com¬ 
pany.  I  want  to  be  fair  to  the  company  and  myself.  Should  I 
continue  until  I  find  a  position  more  aligned  with  my  career 
aspirations,  or  should  I  just  walk  away  now  to  totally  focus  on 
new  opportunities? 

A:  Being  unemployed  while  job  hunting  always  leaves  some 
room  for  doubt:  “Was  there  a  problem?  Was  she  performing 
well?”  This  is  especially  true  in  a  market  in  which  many  poor 
performers  have  been  let  go  under  the  umbrella  of  cost 
reduction.  Since  you  say  that  you  are  doing  your  professional 
best  under  the  circumstances,  then  it  would  seem  that  you 
are  being  as  fair  as  possible  to  your  employer.  In  fairness  to 
yourself,  you  should  keep  your  eyes  and  ears  open  to  the 

market,  and  selectively  make 


Have  a  Career  Question? 


Visit  the  online  CAREER  COUNSELOR 
at  www.cio.com/counselor  to  ask  our 

experts  your  questions  and  browse 
their  answers. 


cio.com 


contact  with  top  recruiters 
to  let  them  know  that  you 
are  available  to  be  consid¬ 
ered  for  larger-scale  oppor¬ 
tunities.  Time  is  on  your  side 


as  the  job  market  continues  to  slowly  improve  and  your 
tenure  at  this  “interim”  position  increases,  thereby  mitigat¬ 
ing  an  early  departure.  Being  employed  but  looking  tells 
prospective  employers  that  the  choice  to  move  on  is  yours. 
-Mark  Polansky,  managing  director  and  member  of  the  advanced 
technology  practice  at  Kom/Ferry  International 

CHANGING  LOYALTIES 

Q:  I  have  worked  for  the  same  boss  for  12  years,  and  my  career 
has  progressed  well  under  his  direction.  However,  he  has  no 
aspirations  to  move  up.  My  next  promotion  would  be  to  his 
level,  and  I  would  like  to  move  up.  How  should  I  approach  the 
CIO  with  this  request? 

A:  Approach  your  CIO  directly — as  soon  as  possible.  Your 
ambition  would  not  be  interpreted  as  disloyal  by  any  think¬ 
ing  person.  Remember,  you  have  given  as  well  as  received 
direction  from  your  superior  during  a  12-year  period:  The 
very  definition  of  loyalty.  But  now  your  loyalty  is  to  yourself 
and  your  career.  If  your  boss  is  a  true  mentor  and  supporter, 
he  will  encourage  your  continuing  success,  and  should 
prove  to  be  a  valued  peer  in  the  future.  -M.P. 

CHANGING  REPORTING 

Q.  I  shifted  to  IT  from  marketing  four  years  ago  when  our  mid¬ 
size  company  implemented  ERP,  and  now  I  lead  the  depart¬ 
ment.  I  have  been  reporting  to  our  CEO,  but  recently  I  have 
been  asked  to  report  to  our  vice  president  of  procurement  and 
logistics.  Should  I  accept  this  reporting  structure? 

A:  If  the  CEO  is  indicating  he  or  she  is  too  busy  to  give  you 
the  time  you  need  and  views  the  vice  president  as  a  key 
leader  with  an  interest  in  IT,  then  this  might  be  a  reasonable 
move.  Do  you  have  projects  that  directly  involve  this  execu¬ 
tive?  If  so,  and  you  have  a  good  working  relationship,  then 
this  might  be  positive  for  you  and  the  company. 

If  you  perceive  this  as  a  demotion,  then  it’s  time  to  consider 
a  job  change.  Most  CIOs  will  tell  you  they  prefer  reporting  to 
the  CEO;  however,  there  are  times  when  reporting  to  another 
top-line  executive  can  be  just  as  satisfying  if  that  person  enables 
you  to  be  a  part  of  the  senior  team  and  provides  avenues  for  par¬ 
ticipating  in  senior-level  meetings  and  committees.  -B.L. 

STEAMED  ENGINE 

Q:  I  was  recently  moved  out  of  my  job  because  of  a  political 
move  by  a  new  CTO.  I  was  leading  the  enterprise’s  e-business 
direction  and  reporting  to  the  vice  president  of  operations, 
who  also  was  the  CIO.  How  do  I  address  this  to  my  next 
employer?  I  have  the  education  and  skills  to  be  a  CTO  or 
more.  But  this  experience  has  left  me  feeling  bitter  and  angry. 
Should  I  tell  my  next  employer  what  happened,  or  should  I 
just  focus  on  my  skills  to  do  the  job? 
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Model  5420  Shown.  Symantec  and  the  Symantec  logo  are  U.S.  registered  trademarks.  Symantec  Gateway  Security  is  a  trademark  of  Symantec  Corporation.  ©2003  Symantec  Corporation.  All  rights  reserved. 


Today’s  threats  require  a  lot  more  than  a  firewall. 
This  is  a  lot  more  than  a  firewall. 


Introducing  the  Symantec™  Gateway  Security  5400  Series.  It  wasn’t  long  ago  that 
a  firewall  provided  all  the  perimeter  protection  an  enterprise  needed.  But  that  was 
before  blended  threats  like  Slammer  and  Blaster.  Now  there’s  the  Symantec  Gateway 
Security  5400  Series,  full  inspection  firewall  appliances  that  integrate  intrusion 
prevention  and  intrusion  detection,  virus  protection,  content  filtering,  anti-spam  and 
VPN.  The  result  is  a  better  defense  against  complex  attacks  and,  thanks  to  centralized 
management  capabilities,  greater  control  over  your  organization’s  perimeter  security. 
To  learn  more  or  to  receive  our  free  multimedia  CD,  “Symantec  Gateway  Security  5400 
Series,”  visit  http://ses.symantec.com/SGS5400  or  call  800  745  6054. 


Firewall 
Intrusion  Prevention 
Intrusion  Detection 
Virus  Protection 
Content  Filtering 
Anti-Spam 
VPN 


It's  OK  to  show  off  to  your 
friends  that  you  were  in  CIO. 


But  it's  even  better  to 
show  your  customers. 


What  better  way  to  inform  your  key  cus¬ 
tomers  of  your  editorial  coverage  in  CIO 
than  through  customized  Editorial 
Reprints? 

Leverage  the  positive  impact  of 
your  editorial  coverage  by  using 
reprints  for  direct  mail  campaigns,  seminar 
promotions,  employee  communications,  recruiting 
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and  marketing  programs.  Let  us  enhance 
your  reprints  with  your  company's  logo, 
address,  and  sales  message.  Reprints 
make  great  SALES  tools  for  trade  shows, 
mailings  or  media  kits. 

And  while  a  framed  copy  of  your  article 
will  look  neat  on  your  wall,  it  will  look  even 
better  in  the  hands  of  your  customers. 


For  more  information  on  customized  editorial  reprints  in  volume  quantities,  contact  Jackie  Day  at  651-582-3856 

or  visit  our  website  at  cio.com/marketing  and  click  on  reprints. 


Career  Counsel 


A:  Until  you  can  come  to  peace  with  the  loss  of  your  job,  I’m 
afraid  your  bitterness  will  get  in  the  way.  Candidly,  it  is 
naive  of  you  to  think  of  the  world  as  a  perfect  meritocracy 
where  employment  decisions  are  made  objectively  and  with¬ 
out  political  influence.  If  you  don’t  care  to  develop  your  sur¬ 
vival  skills,  consider  a  consulting  position  or  possibly  a 
career  in  the  academic  or  nonprofit  worlds.  To  be  sure, 
there’s  lots  of  politics  in  these  fields,  too,  but  you  are  less 
likely  to  encounter  there  what  you  have  called  “reckless 
behavior.”  In  any  case,  you  should  be  selling  yourself  and 
your  capabilities.  Simply  state  the  facts — you  were  let  go  as 
a  result  of  a  change  of  leadership,  by  a  CTO  who  wished  to 
choose  his  own  staff.  Put  aside  your  CTO  wishes  for  now 
and  interview  for  opportunities  at  your  level  of  experience, 
not  at  the  level  of  your  future  career  expectations. 

-M.P. 


WRONG  GAUGE 

Q:  I  have  more  than  15  years  of  experience  on  the  technical 
side  of  IT  at  the  vice  president  and  director  level.  I’m  shooting 
for  CIO,  but  I  seem  to  notice  a  pattern  that  all  CIOs  come  from 
the  applications  side  of  IT.  Is  my  observation  correct? 


A:  Yes.  The  technical  side  of  IT — namely  the  infrastructure 
and  its  care  and  feeding — is  not  what  creates  value  and  com¬ 
petitive  advantage  for  your  employer.  The  engineering,  man¬ 
agement  and  support  of  data  centers  and  IT  operations  is  the 
“utility”  part  of  what  we  do,  and  therefore  it  is  the  first  to  be 
outsourced,  rationalized,  consolidated  or  otherwise  mini¬ 
mized.  Conversely,  innovation  in  business  applications  has 
the  potential  to  optimize  business  operations — it  is  therefore 
crucial  and  core  to  any  organization’s  performance.  Talk  to 
your  CIO  about  your  desire  to  cross  over  and  get  closer  to  the 
revenue.  Sell  your  leadership  skills  and  underlying  technical 
expertise;  ask  for  a  transfer  at  whatever  level  management 
thinks  may  be  appropriate.  Study,  work  hard  and  develop 
your  new  skills  in  applications  design  and  development.  In 
the  future,  you  will  be  pleased  to  find  that  your  new  compe¬ 
tencies  in  business  systems,  coupled  with  your  previous  tech¬ 
nology  background,  will  differentiate  you  as  a  well-rounded 
CIO  prospect.  -M.P.  BE! 


The  Web-based  Executive  Career  Counsel  column,  which  can  be  found 
online  at  www.cio.com/counselor,  is  edited  by  Director  of  Online 
Research  Kathleen  Kotwica  ( kkotwica@cio.com ). 
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throughout  the  entire  process.  We  are  a  resource  of  knowledge  with  experience  across  a  broad 
range  of  carriers.  We  are  analysis  experts,  creating  leading-edge  pricing  and  contract  terms.  We 
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Disposable 
technologies 
promise 
convenience 
and  savings... 
but  at  a  price 


Use  It  and  Lose  It 

BY  JOHN  EDWARDS 

DISPOSABLES  I  In  the  18th  and  early  19th  centuries,  hand-wrought  nails  were  so  precious 
that  when  a  house  burned  down,  the  owner  and  his  friends  would  sift  through  the  wreckage  to 
retrieve  the  hardware.  Today,  thanks  to  modern  mass-production  techniques,  nails  are  dispos¬ 
able  items. 

Modern  technology  is  exerting  a  similar  effect  on  the  way  people  view  many  electronic  prod¬ 
ucts.  Yesterday’s  exotic,  highly  prized  electronic  devices  generally  are  treated  with  casual  disre¬ 
gard  by  today’s  users.  “We  live  in  a  disposable  society,  ”  observes  Randi  Altschul,  inventor  of  the 
world’s  first — and  as  yet  unsuccessful — disposable  mobile  phone.  (It’s  made  of  paper.)  “We 
want  everything  fast  and  short  term.” 

In  the  past,  high  product  price  and  relatively  low  repair  costs  encouraged  people  to  attempt 
to  extend  the  life  of  even  fairly  trivial  devices.  Today,  with  product  prices  and  repair  costs  flipped, 
it’s  often  cheaper  to  toss  away  a  device  once  it  breaks  or  becomes  outdated,  rather  than  trying 
to  repair  or  upgrade  it.  As  a  result,  a  staggering  array  of  products,  including  RFID  tags,  dis¬ 
plays,  mobile  phones,  digital  cameras  and  printers  are  all  falling,  or  have  already  fallen,  into  the 
“use  it  and  lose  it”  category. 

With  more  disposable  technologies  flooding  the  mainstream,  CIOs  face  a  dilemma.  On  the 
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one  hand,  low-priced  throwaway  gadgets 
save  enterprises  money  by  reducing  or  elimi¬ 
nating  the  costs  of  repair  and  maintenance. 
On  the  other  hand,  disposable  technologies 
carry  their  own  baggage,  including  significant 
security  and  environmental  concerns.  Bal¬ 
ancing  disposability’s  risks  with  its  benefits  is 
one  of  the  key  challenges  CIOs  will  face  in  the 
coming  years. 

Tracking  Disposability 

Products  are  disposable  when  they  become  so 
inexpensive  that  the  buyer  has  little  regard  for 
their  purchase  price.  This,  in  turn,  leads  to 
broader  use.  In  the  RFID  sector,  for  example, 
falling  tag  prices  encourage  the  tracking  of 
ever  less  consequential  items. 


other  park  venues.  At  the  end  of  the  day,  bands 
are  thrown  away  or  saved  as  souvenirs. 
Although  more  expensive  than  bar-code 
imprinted  wristbands,  the  RFID  devices  aren’t 
vulnerable  to  damage  caused  by  pool  chemi¬ 
cals,  the  sun  or  stretching.  “The  fact  that 
they’re  disposable  means  that  we  don’t  have  to 
worry  about  the  bands’  long-term  physical 
integrity,”  says  Bob  Owens,  an  assistant  man¬ 
ager  at  the  park. 

As  with  any  technology  that  carries  personal 
or  financial  information,  particularly  a  dispos¬ 
able  product,  security  is  critical.  Financial  and 
identification  data  stored  on  the  band  is 
encrypted,  preventing  unauthorized  users  from 
reading  data.  While  users  can  use  their  credit 
card  to  purchase  things  in  the  park,  card 


Disposable  technologies  carry  their 
own  baggage,  including  significant 
security  ana  environmental  concerns. 


At  the  moment,  tag  prices  are  still  high 
enough — around  20  cents  each — to  prevent 
item-level  tracking  of  low-cost  products  such 
as  groceries.  Jeff  Woods,  a  principal  analyst  at 
Gartner,  believes  that  when  tags  hit  the  5  cent 
level,  “then  [RFID]  can  turn  into  a  consum¬ 
able,  disposable  technology.” 

But  RFID  can  already  be  considered  a  dis¬ 
posable  technology  when  it  comes  to  certain 
high-cost  products,  such  as  a  plasma  TV  or  a 
Prada  handbag.  People  are  another  type  of 
“high-value  asset”  that  can  be  tracked  by 
RFID.  Precision  Dynamics  makes  a  wrist¬ 
band,  incorporating  Texas  Instruments’  RFID 
chip  technology,  that  can  be  worn  by  hospital 
patients,  schoolchildren,  and  theme  park  and 
sporting  event  attendees. 

At  Hyland  Hills  Water  World,  a  water  park 
in  Federal  Heights,  Colo.,  RFID  wristbands 
may  take  the  place  of  cash  and  credit  cards 
(the  park  beta-tested  the  wristbands  last  year 
and  is  considering  installing  the  system  this 
summer).  The  bands  work  as  wearable  debit 
cards,  allowing  people  to  spend  money  sim¬ 
ply  by  waving  their  banded  wrists  in  front  of 
readers  located  at  snack  bars,  gift  shops  and 


account  data  isn’t  stored  on  the  band.  “That 
information  is  kept  on  our  server”  says  Owens. 

The  system  also  eliminates  the  park’s  need 
to  transport  large  sums  of  cash  to  a  bank  at 
the  end  of  the  day.  “There’s  a  great  conven¬ 
ience  factor  with  this  technology,”  says 
Owens.  The  park  also  benefits  from  “break¬ 
age” — the  unspent  credit  that  remains  on 
bands  after  visitors  leave  the  park. 

Throwaway  Circuits 

Unlike  RFID  tags,  which  provide  only  tracking 
capabilities,  inexpensive  monitoring  circuits 
enable  enterprises  to  carefully  monitor  the 
condition  of  key  assets.  Cypak,  for  instance, 
has  developed  a  sensor-based  monitoring  tech¬ 
nology  that’s  aimed  at  product  delivery  sur¬ 
veillance  and  control.  Using  special  conductive 
inks,  Cypak  prints  a  circuit,  environmental 
sensors  and  an  antenna,  and  it  mounts  micro¬ 
electronics  directly  onto  shipping  packages. 
The  company’s  SecurePak  technology  stores 
a  unique  ID  that  can  be  programmed  with 
unalterable  information  about  the  package’s 
source,  destination  and  contents.  SecurePak 
can  then  record  whether  the  package  it’s 


A  Throwaway 
Idea 

The  sad  tale  of  the  paper  phone 

Back  in  1999,  inventor  Randi  Altschul 
thought  she  had  a  killer  idea— an  inexpen¬ 
sive  mobile  phone,  priced  at  about  $10, 
that  could  be  tossed  away  on  a  whim,  Five 
years  later,  Altschul’s  killer  idea  may  itself 
be  dead. 

At  the  telecom  boom's  height,  Altschul’s 
invention  sounded  like  a  surefire  proposi¬ 
tion.  Her  phones  would  be  so  cheap  that 
fast-food  chains  would  want  to  sell  adver¬ 
tising-emblazoned  models  along  with 
their  combo  meals.  "I  took  the  toy  mental¬ 
ity  to  telecom  and  turned  a  phone  into  a 
toy,"  she  says.  "It  can  be  made  of  paper  or 
polyester  and  is  so  inexpensive  that  it's 
disposable." 

Altschul’s  dream  ran  into  trouble  when 
she  tried  to  attract  financial  backers. 
Altschul's  harrowing  experiences  in  the 
world  of  high-tech  capitalism  led  her  to 
self-publish  a  book:  Financiers,  Lawyers 
and  Other  Assorted  Snakes.  By  the  time 
Altschul  was  ready  to  move  on,  the  bloom 
had  faded  from  the  telecom  market  rose 
and  investors  were  licking  wounds  created 
by  other  seemingly  no-lose  telecom  ideas. 
"Nothing  ever  hit  the  market,  though 
many  people  talked  [to  me],"  she  says. 

The  mobile  phone  market  has  now 
evolved  beyond  Altschul’s  original  concept. 
With  more  phone  buyers  looking  for  high- 
end  features,  such  as  MP3  file  downloading 
and  color  cameras,  the  market  for  a  1999- 
style  disposable  phone  has  faded.  Yet 
Altschul  remains  undaunted.  "I  still  envi¬ 
sion  the  same  opportunities  and  much 
more,"  she  says.  "It  will  just  begin  a  little 
later  than  I  wanted." 

-J.E. 
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IBM  Express  Middleware:  Designed 
and  developed  for  midsize  companies. 

(IBM  muscle  for  less  moolah.) 


MIDDLEWARE  IS  POWERFUL  IBM  SOFTWARE.  The  kind  of  software  that  makes  your  applications 
work  better  to  solve  your  business  problems.  It’s  an  answer.  It’s  IBM  DB2f  Lotusf  Tivoli®  and  WebSphere® 
And  in  the  form  of  IBM  Express  Middleware,  it’s  now  more  accessible  than  ever  for  midsize  businesses. 

IBM  Express  Middleware  is  engineered  to  work  with  your  existing  business  applications  whether  they  run 
on  Windowsf  Linux®  or  UNIX®  It’s  engineered  to  be  deployed  by  those  without  computer  science  degrees. 
It’s  priced  to  put  a  smile  on  Accounting’s  face.  It’s  nimble.  Quick.  Flexible. 

Your  technology  will  work  harder  to  meet  the  demands  of  your  customers,  your  business  goals  and  your 
industry’s  needs.  It  makes  your  business  more  responsive  to  the  unforeseen.  Of  course,  all  of  this  is  easy 
to  implement,  easy  to  install,  simple  to  maintain.  You  need  to  learn  more.  To  find  an  IBM  Business  Partner 
in  your  area,  visit  ibm.com/software/express 


IBM,  DB2,  Lotus,  Tivoli  and  WebSphere  are  registered  trademarks  or  trademarks  of  International  Business  Machines  Corporation  in  the  United  States  and/or  other  countries.  Linux  is  a 
registered  trademark  of  Linus  Torvalds.  Windows  is  a  registered  trademark  of  Microsoft  Corporation  in  the  United  States  and/or  other  countries.  UNIX  is  a  registered  trademark  of  The  Open 
Group  in  the  United  States  and/or  other  countries.  ©2004  IBM  Corporation.  All  rights  reserved. 


attached  to  has  been  opened,  resealed  or  tam¬ 
pered  with  in  any  way  during  shipping  and  can 
even  tell  shippers  and  package  recipients  when 
and  where  such  incidents  occurred.  The  cir¬ 
cuitry  adds  about  $2  to  a  package’s  cost,  notes 
Jakob  Ehrensvard,  Cypak’s  CEO.  “This  is 
basically  a  chip  on  a  sticker,”  he  says.  The 
reader  costs  about  $10. 

The  Swedish  Postal  Service  recently  tested 
SecurePak  for  shipping  high-value  and  confi¬ 
dential  items  such  as  computer  equipment, 
precious  artwork  and  government  docu¬ 
ments.  Thord  Axelsson,  the  postal  service’s 
chief  security  officer,  says  the  technology  lets 
postal  employees  quickly  determine  when  and 
where  a  package  has  been  opened,  making  it 
cheaper  and  easier  for  postal  authorities  to 
pinpoint  security  weaknesses.  Without  the 
technology,  finding  the  source  of  a  package¬ 
tampering  incident  could  require  one  to  two 


tion  engine  that’s  designed  to  keep  unautho¬ 
rized  users  from  resetting  the  sensors  or  peer¬ 
ing  into  shipping  information,  even  after 
packaging  material  containing  the  SecurePak 
circuitry  has  been  thrown  away.  “The  infor¬ 
mation  is  protected  even  after  it  leaves  our  sys¬ 
tem,”  says  Axelsson. 

Gone,  but  Not  Forgotten 

As  a  growing  number  of  disposable  devices 
find  their  way  into  everyday  life,  some  people 
are  concerned  about  their  environmental 
impact.  The  technology  industry  has  strug¬ 
gled  for  years  with  the  problem  of  how 
to  effectively  rescue  and  recycle  an  ever- 
increasing  torrent  of  “digi-effluvia.”  Many 
people  now  fear  that  a  flood  of  future  dispos¬ 
able  devices  such  as  mobile  phones,  PDAs, 
digital  cameras  and  MP3  players  will  glut 
already  overflowing  landfills. 


Many  people  fear  that  a  flood  of  future 
disposable  devices  will  glut  already 
overflowing  landfills. 


weeks  of  investigation.  With  SecurePak,  the 
information  is  available  almost  instantly. 

SecurePak  can  even  tell  its  user  exactly 
how  a  package  was  tampered  with  such  as 
“if  it  was  opened  indirectly  or  if  they  used  a 
knife  on  the  package,”  says  Axelsson.  A  cus¬ 
tomer  slicing  a  package  with  a  knife,  for 
example,  may  violate  a  shipper’s  instruc¬ 
tions  designed  to  protect  the  merchandise. 
SecurePak’s  sensors  also  reveal  if  shipments 
have  been  exposed  to  potentially  damaging 
environments,  such  as  extreme  heat  or  cold  or 
rough  handling. 

Axelsson  says  the  technology  is  cheap 
enough  to  be  disposable,  yet  rugged  enough  to 
be  reused  several  times.  Although  Axelsson 
was  initially  dubious  that  such  a  small,  inex¬ 
pensive  technology  could  provide  so  much 
information,  the  recent  tests  have,  in  his  opin¬ 
ion,  proven  SecurePak’s  value. 

Axelsson  isn’t  worried  about  SecurePak- 
equipped  packages  falling  into  the  wrong 
hands.  The  system  includes  a  built-in  encryp- 


Such  concern  is  not  unfounded.  Yet  many 
disposable  products  are  being  developed  with 
an  eye  toward  protecting  the  environment. 
The  design  for  Altschul’s  paper-based  dispos¬ 
able  mobile  phone,  for  example,  is  more  envi¬ 
ronmentally  friendly  than  its  plastic  and  metal 
counterparts.  “Our  phones  will  be  made  to 
disintegrate  with  the  elements  over  time,”  she 
promises.  Organic  light-emitting  diodes 
(OLEDs),  which  could  ultimately  be  sprayed 
onto  disposable  items  such  as  signs  and  cereal 
boxes  to  create  colorful  and  animated  dis¬ 
plays,  are  also  considered  to  be  eco-friendly. 
“You  can  eat  the  new  OLEDs,”  notes  Peter 
Harrop,  chairman  of  IDTechEx,  an  RFID 
consultancy.  Emerging  disposable  devices  also 
can  be  successfully  integrated  into  existing 
recycling  programs.  “We  are  very  green  about 
the  environment  in  Sweden,  and  we  already 
have  special  programs  for  packing  materials,” 
observes  Axelsson. 

Some  kinds  of  disposable  technology 
could  actually  help  preserve  the  environ- 


Landfill  Fodder 

‘Only  one  billion 

RFID  tags  have 
been  sold  in  the 
last  50  years. 

The  next  billion 

will  be  delivered 
in  the  next  year.’’ 

-Peter  Harrop,  chairman,  IDTechEx 


ment.  Digital  paper,  which  can  be  printed  on 
several  times  before  wearing  out,  could 
reduce  the  number  of  trees  felled  each  year 
to  produce  the  blizzard  of  paper  needed  to 
run  most  offices.  Additionally,  unalterable 
RFID  tags  or  sensor  circuits,  when  embed¬ 
ded  into  hazardous  products,  could  let 
authorities  trace  items  that  are  illegally  dis¬ 
carded  by  their  owners.  RFID  could  also  be 
used  to  spot  and  reclaim  tagged  items  con¬ 
taining  valuable  materials  that  are  dumped 
into  landfills. 

A  Molecular  Level 

As  digital  components  grow  smaller,  they  will 
become  increasingly  integrated  into  everyday 
objects,  such  as  office  machines,  home  appli¬ 
ances  and  even  clothing.  As  a  result,  people 
and  businesses  eventually  may  begin  to  lose 
sight  of  the  need  for  recycling.  Few  people, 
for  example,  think  about  recycling  the  but¬ 
tons  on  a  discarded  shirt  or  the  zipper  on  a 
worn  pair  of  jeans.  The  garment  as  a  whole 
may  be  recycled,  but  not  each  and  every  com¬ 
ponent. 

Yet  the  need  to  recycle  isn’t  likely  to  go  away, 
and  highly  integrated  technologies  such  as  the 
smart  clothing  currently  being  developed  by 
Sundaresan  Jayaraman  could  actually  make 
technology  recycling  far  more  complex. 
Jayaraman,  a  professor  of  textile  engineering 
at  the  Georgia  Institute  of  Technology,  is  work¬ 
ing  on  several  types  of  smart  clothing,  including 
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Circuits  on  Everything! 


garments  that  incorporate  computing  and 
communications  functions. 

Figuring  out  how  to  recycle  smart  cloth¬ 
ing  promises  to  be  a  daunting  task.  “Dis¬ 
posable  [smart]  clothing  will  be  a  challenge 
because  it  will  involve  lots  of  different  ma¬ 
terials,  all  close  against  one  another,”  says 
Edwin  Thomas,  a  materials  science  and 
engineering  professor  at  MIT,  who  is  also 
working  on  smart  clothing. 

Eventually,  in  order  to  recycle  electronic 
products  effectively  and  efficiently,  recov¬ 
ery  technologies  will  have  to  begin  mimick¬ 
ing  natural  processes  by  working  on  a 
molecular  level.  “Right  now,  we  have  this 
cereal  box,  and  we  think  this  has  to  be  recy¬ 
cled  into  more  paper,”  says  Christine  Peter¬ 
son,  president  of  the  Foresight  Institute,  a 
technology  think  tank.  “That’s  what  we 
know  how  to  do  now,  and  that’s  what’s 
cheap  to  do  now,  but  that  certainly  doesn’t 
have  to  be  the  case,”  she  notes.  Molecular 
recycling  would  allow  discarded  prod¬ 
ucts — such  as  a  shirt  incorporating  a  radio 
transceiver  and  an  OLED  screen — to  be 
recycled  without  first  breaking  it  down  to 
its  component  parts:  cotton,  metal,  plastic 
and  so  on.  “We  need  to  get  much  better  at 
taking  arrangements  of  atoms  and  mole¬ 
cules  and  changing  them  into  what  we 
want,”  says  Peterson. 

In  the  meantime,  Thomas  believes  that 
manufacturers  should  work  together  to 
make  devices  that  use  similar,  easily  recy¬ 
clable  materials.  He  notes  that  tech  vendors 
could  take  a  tip  from  ketchup  makers. 
“Ketchup  bottles  used  to  be  made  from 
seven  different  kinds  of  plastic,”  he  notes. 
“They  were  terrific  bottles,  except  that  you 
commingled  seven  different  plastics,  and 
there  was  really  no  way  to  separate  them.  ” 
Now,  thanks  to  a  unified  standard,  the  bot¬ 
tles  are  easily  recyclable.  Like  the  ketchup 
makers,  device  vendors  could  collaborate 
on  using  similar  materials  in  cases,  circuit 
boards  and  other  major  components.  “It’s  a 
way  of  thinking  green,”  says  Thomas. 


John  Edwards  is  a  freelance  writer  based 
in  Arizona.  He  can  be  reached  at  john@ 
john-edwards.com. 


NANOTECH  |  Nanotechnology  has 
many  reputations,  ranging  from  "historic 
opportunity”  to  "potential  cataclysm.”  At 
Nanosys,  a  Palo  Alto,  Calif.-based  research 
and  development  company,  they’d  rather 
that  it  just  prove  useful. 

"Our  goal  is  to  be  able  to  provide  a 
[nanotech-based]  component  that  [our 
partners]  can  seamlessly  integrate  into  their 
own  manufacturing  process,”  says  Stephen 
Empedocles,  cofounder  and  director  of 
business  development  at  Nanosys.  That 
integration  could  lead  to  any  of  a  number  of 
product  improvements,  from  lowering  man¬ 
ufacturing  costs  to  increasing  a  part’s  life 
expectancy  to  enhancing  performance. 

The  company  is  currently  working  in 
three  areas  of  potential  product  develop¬ 
ment:  photovoltaic,  or  solar  cells;  thin-film 
electronics,  such  as  those  used  in  flat-panel 
displays;  and  surface  coating  technology 
that  would  allow  flexible  electronic  circuits 
to  be  printed  onto  objects. 

Nanosys  technology  has  attracted  the 
attention  of  a  number  of  highly  visible— if 
sometimes  rather  secretive— partners.  The 


company  has  received  backing  from  the 
CIA’s  investment  arm,  In-Q-Tel.  Plus  it  cur¬ 
rently  has  agreements  with  the  likes  of  the 
Defense  Advanced  Research  Projects 
Agency  and  Intel  (with  whom  it  is  working 
on  a  nanotech-based  memory  project.  “The 
only  group  that’s  probably  more  secretive 
than  [the  CIA]  is  Intel,”  Empedocles  quips). 

On  the  less  mysterious  side,  Empedocles 
says  that  a  collaboration  with  Matsushita 
Electric  Works  in  Japan  will  likely  result  in 
new  nanotech-enhanced  photovoltaicsthat 
will  allow  Matsushita  to  integrate  solar  cells 
with  building  materials,  creating  a  roofing 
tile  that  doubles  as  a  source  of  electricity,  for 
example.  Products  based  on  the  technology 
are  slated  for  release  in  2006,  according  to 
Empedocles.  Other  Nanosys  products  also 
are  making  headway,  such  as  its  thin-film 
technology,  which  could  finds  its  way  into 
less  expensive  and  less  power-hungry  lap¬ 
top  computer  screens  in  only  a  few  years. 

“We  have  a  lot  of  long-term  visions,” 
Empedocles  says.  “[But]  we  create  a  lot  of 
short-term  opportunities.” 

-Christopher  Lindquist 
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Guard  the 
Application  Layer 

BY  ERIC  KNORR 

Firewalls  alone  are  no  longer  enough  to  protect 
your  online  assets 


SECURITY  |  Back  in  the  day,  just  before 
the  launch  of  a  dotcom  I  now  regret  being  asso¬ 
ciated  with,  I  asked  our  chief  developer  about 
security  risks  to  subscriber  data.  “We’ve  put 
two  network  cards  in  the  Web  server,”  he 
grinned.  “So  the  database  communicates  with 
the  Web  server  on  a  separate  network.  Any¬ 
one  who  hacked  into  our  Web  server  wouldn’t 
even  know  the  database  was  there.  ” 

Maybe  that  was  good  enough  for  1998. 
But  today,  hackers  and  their  attack  strategies 
are  smarter  and  much  more  ambitious.  The 
threat  of  the  day  is  the  application  attack, 
which  sneaks  through  your  firewall  and  into 
your  Web  applications.  And  yes,  some  of  these 
attacks  like  to  dine  on  tasty  customer  data. 

If  you’ve  got  a  low-profile  site,  you  proba¬ 
bly  don’t  need  to  worry.  But  if  a  lot  of  people 
know  about  you,  you’re  at  risk.  It  may  sound 
paranoid,  but  someone  could  abscond  with 
your  customers’  Social  Security  numbers  and 
you’d  never  know. 

So  why  don’t  ordinary  firewalls  stop  these 
attacks?  Because  they’ve  been  designed  to 
appear  as  well-formed  traffic,  with  no  unusu¬ 
ally  large  packets  or  suspicious  mismatches 
between  address  and  content  to  sound  the 
alarm.  One  of  the  most  frightening  examples 
is  the  SQL  injection.  Here,  hackers  can  use 
one  of  your  own  HTML  forms  to  run  unau¬ 
thorized  queries  on  your  database.  Another 
threat:  command  execution.  Whenever  Web 
applications  pass  commands  to  a  shell  appli¬ 


cation,  a  clever  hack  can  cause  arbitrary  com¬ 
mands  to  execute  on  the  server. 

Other  attacks  are  simpler.  For  example, 
HTML  comments  often  contain  sensitive 
information,  including  log-ins  left  by  incau¬ 
tious  programmers.  Ultimately,  the  lines  of 
attack  on  the  application  layer — from  alter¬ 
ing  cookies  to  changing  hidden  fields  in 
HTML  forms — are  limited  only  by  hacker 
imagination.  But  the  good  news  is  that  most  of 
these  attacks  can  be  stopped  cold. 

Two  complementary  approaches,  when 
combined,  provide  a  solid  defense.  First,  use 
an  application  scanner  to  scour  your  Web 
apps  for  vulnerabilities.  Then  get  yourself  a 
Web  application  firewall  to  keep  the  bad  guys 
from  breaking  and  entering. 

Application  scanners  basically  launch  a 
host  of  simulated  attacks  on  your  server  and 
report  on  the  results.  KaVaDo  ScanDo,  Sanc¬ 
tum  AppScan  Audit  and  SPI  Dynamics  all  do 
a  pretty  thorough  job  itemizing  flaws  and  rec¬ 
ommending  fixes.  AppScan  Audit  is  particu¬ 
larly  interesting,  because  it’s  the  after-the-fact 
member  of  a  suite  of  products  that  help  pro¬ 
grammers  catch  vulnerabilities  as  they  code. 
None  of  these  packages,  however,  can  beat  a 
full-scale  audit  by  security  pros. 

Once  you’ve  plugged  the  holes  as  best  you 
can,  it’s  time  to  deploy  a  Web  application  fire¬ 
wall.  These  work  in  an  interesting  way:  by 
learning  what  well-formed  traffic  to  and  from 
an  application  looks  like  and  identifying  the 


Ultimately, 
the  lines  of 
attack  on  the 
application 
layer— from 
altering  cookies 
to  changing 
nidden  fields  in 
HTML  forms— 
are  imited 
only  by  hacker 
imagination. 


unexpected.  To  do  this,  Web  app  firewalls  must 
inspect  packets  at  a  deeper  level  than  do  ordi¬ 
nary  firewalls.  Check  Point  is  the  best-known 
brand  in  this  area,  but  the  other  vendors  are  rel¬ 
atively  obscure:  KaVaDo,  NetContinuum, 
Sanctum  and  Teros.  Some  of  these  Web  app 
firewalls  are  available  as  software,  others  as 
appliances,  others  as  either.  But  don’t  mistake 
this  for  plug  and  play,  even  in  the  case  of  the 
appliances.  As  with  intrusion  detection,  you 
need  to  calibrate  Web  application  firewalls 
carefully  to  reduce  false  positives  without  let¬ 
ting  sneaky  attacks  through. 

In  the  end,  I  wish  such  elaborate  defense 
measures  were  unnecessary.  Thanks  to  spam 
and  ever  more  sophisticated  attacks,  it  seems 
inevitable  that  the  public  Internet  will  devolve 
into  overlapping  virtual  private  networks. 
Meanwhile,  we  have  no  choice  but  to  turn  to 
increasingly  clever  gadgets  to  stave  off  the  bar¬ 
barian  hordes. 


Eric  Knorr  is  executive  editor  at  large  at  InfoWorld. 
He  can  be  reached  at  eknorr@pacbell.net. 
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Samsung’s  Four  Seasons  of  Hope,  Circuit  City  and  Joe  Torre  have  teamed  up  to 
make  a  difference  in  the  community.  Circuit  City  and  Samsung  will  conduct  several 
promotions  to  help  raise  funds  for  the  Joe  Torre  Safe  at  Home  Foundation,  like 
donating  $1000  for  every  home  run  hit  by  Joe’s  team  at  Yankee  Stadium  during  the 
regular  season.  The  Joe  Torre  Safe  at  Home  Foundation  raises  funds  to  support 
the  development  and  implementation  of  a  comprehensive  educational  program 
through  awareness  campaigns  and  targeted  curricula  for  youth.  To  find  out  how 
you  can  help,  visit  www.joetorre.com  or  call  877-868-4JOE. 
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Please  join  Samsung,  Circuit  City 
and  Joe  Torre  to  help  prevent 
domestic  violence. 
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Meet  Joe  (not  his  real  name). 


Joe  forgot  how  much 
was  riding  on  his  decision. 


He  forgot  about  the 
CIO  Evaluation  Center 


Don’t  make  Joe’s 
mistake... 


Announcing  the  CIO  Evaluation  Center.  CIO  magazine  and  Technology  Evaluation  Centers  Inc.  have 
joined  forces  to  make  available  to  CIO  magazine  readers,  a  cutting  edge  online  tool  that  impartially 
compares  enterprise  software  products,  side-by-side  and  interactively. 

It  could  have  shown  Joe  which  product  best  matched  his  needs. 

Joe  was  last  seen  scrutinizing  the  CIO  Evaluation  Center  at:  http://www.theciostore.com 
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COVER  STORY 
Hand  Over  Security 

By  Christopher  Koch  I  48 

There  is  growing  evidence  that  security 
responsibility  should  be  independent 
of  the  IT  department — survey  data 
shows  that  companies  with  independent 
security  functions  enjoy  more  effective  safe¬ 
guards.  With  security  reporting  to  IT,  there  is 
potential  conflict  of  interest  for  the  CIO, 
who  might  be  tempted  to  give  short  shrift  to 
security  concerns  in  favor  of  getting  IT  proj¬ 
ects  in  on  time  and  under  budget.  Catching 
hackers  requires  the  ability  to  think  like  a 
criminal,  something  IT  employees  are  not 
trained  to  do.  And,  of  course,  there’s  the 
enormous  IT  workload  that  distracts  from 
security  concerns.  On  the  other  hand,  even  if 
security  moves  out  of  IT,  accountability 
wouldn’t  necessarily  go  with  it.  CIOs  might 
end  up  with  little  influence  but  would  still 
have  to  answer  when  something  went 
wrong.  But  at  Capital  IQ  and  Siemens 
Canada,  responsibility  for  security  has  been 
successfully  separated  from  IT.  If  that’s  not 
possible,  security  advocates  say  the  responsi¬ 
ble  person  must  have  the  policy-based 
recourse  to  report  to  a  higher  authority  than 
the  CIO. 

“Security  and  IT  should 
be  like  the  Supreme 
Court  and  the  executive 
branch.  You  want  them 
to  work  together,  but  you 
want  that  independent 
oversight.” 

-WILLIAM  MURPHY,  CTO  OF  FINANCIAL 
DATA  AND  ANALYTICAL  SOFTWARE 
PROVIDER  CAPITAL  IQ 


AT&T  Wireless  Self-Destructs  By  Christopher  Koch  I  56 

LAST  FALL,  AT&T  Wireless  frantically  tried  to  complete  a  CRM  upgrade  to  Siebel  7.  It  had  to  be 
done  in  time  to  handle  the  customer  service  challenges  accompanying  a  Federal  Communications 
Commission  deadline  for  allowing  customers  to  change  carriers  without  changing  their  phone  num¬ 
bers.  The  effort  was  a  failure.  Systems  crashed  and  stayed  down.  Customer  reps  could  not  keep  up, 
and  angry  customers  abandoned  the  carrier.  The  weakened  company  was  ultimately  bought  out  by 
rival  Cingular.  Through  exclusive  interviews  with  company  insiders,  we  piece  together  what  went 
wrong  and  highlight  the  key  project  management  lessons,  including  the  pitfalls  of  poor  planning  and 
the  deleterious  effects  of  an  ill-timed  outsourcing  push. 


In  Sync  With  His  CEO  By  Susannah  Patton  I  66 

JOHN  BROWNE,  the  CEO  of  British  Petroleum,  has  pursued  an  aggressive  leadership  agenda  that 
has  unleashed  a  wave  of  mergers  and  acquisitions  across  the  energy  industry  and  set  the  trend  for  ruth¬ 
less  cost-cutting.  John  Leggate,  Browne’s  handpicked  CIO,  has  responded  by  taking  on  the  task  of 
integration,  using  Browne’s  aggressive  cost-cutting  tactics  to  slash  redundant  jobs  and  programs,  and 
continuing  to  outsource  dozens  of  key  IT  services.  Leggate’s  proven  himself  as  both  a  risk-taker — not 
afraid  to  invest  in  new  technologies  for  the  long  term — and  a  pragmatist,  working  diligently  to  calcu¬ 
late  the  payback  for  BP’s  IT  investments  and  to  show  how  IT  can  help  shape  corporate  strategy.  His  five 
years  as  a  successful  CIO  under  Browne  teaches  lessons  in  how  to  mirror  the  philosophies  and  strategies 
of  the  business  and  its  chief  executive,  and  master  the  many  challenges  and  politics  of  M&A  integration. 


Something  Ventured,  Something  Gained  By  Kim  Girard  I  74 

VENTURE  CAPITAL  FIRMS  AND  CIOS  are  increasingly  plumbing  a  symbiotic  relationship. 
VCs  get  guidance  and  reality  checks,  as  well  as  potential  early  customers.  CIOs  gain  influence  over 
technology  development  and  exposure  to  the  latest  innovations.  The  most  popular  format  for  the 
relationship  is  a  VC-sponsored  CIO  council,  such  as  the  15-month-old  Technology  Council  run  by 
J.P.  Morgan  Partners,  which  has  24  CIO  members  who  collectively  represent  $6  billion  in  technology 
spending.  Two-thirds  of  council  CIOs — including  those  of  1-800-Flowers.com,  Domino’s  Pizza, 
Guitar  Center  and  House  of  Blues — come  from  J.P.  Morgan  Partners’  portfolio  companies.  The  rest 
are  “outsider”  CIOs — including  those  from  E-Trade,  Otis  Elevator,  Priceline.com  and  the  Vanguard 
Group — who  were  invited  to  give  an  independent  perspective.  CIOs  thinking  of  participating  in  such 
councils  must  be  careful  to  avoid  conflicts  of  interest,  and  VCs  need  to  know  the  CIOs  well  enough 
not  to  waste  their  time  on  irrelevant  technologies. 


How  to  Put  Your  Customers  to  Work  ByCXPrahaiadandVenkatRamaswamy  I  82 

IN  THEIR  BOOK,  The  Future  of  Competition,  C.K.  Prahalad  and  Venkat  Ramaswamy  contend 
that  companies  need  not  (and  should  not)  go  it  alone  when  trying  to  create  value.  Their  research  sug¬ 
gests  an  emerging  economic  model  of  value  cocreation,  in  which  consumers  and  companies  routinely 
collaborate  to  create  personalized  value.  I  n  the  world  of  cocreation,  imagine  every  individual  who 
interacts  with  the  company  as  a  “consumer,”  and  discard  the  artificial  distinctions  among  enterprises 
and  households.  And  don’t  mistake  self-service  for  customer  involvement.  Cocreation,  the  authors 
maintain,  is  not  the  transfer  or  outsourcing  of  activities  to  customers  or  a  marginal  customization  of 
products  and  services.  It  isn’t  scripting  or  staging  of  customer  events  around  the  company’s  offerings. 
Those  kinds  of  company-customer  interactions  no  longer  satisfy  most  consumers  today.  It’s  the  cocre¬ 
ation  experience  (not  the  offering)  that  is  the  basis  of  value  for  each  individual. 
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CUT  YOUR 
IT  BUDGETS 
NOW 


Sun  Java  Enterprise  System 


FIND  OUT  HOW  MUCH  YOU  CAN  GET 
AND  HOW  MUCH  YOU  CAN  SAVE  AT: 

SUN.COM/JES 


&Sun 

microsystems 


The  Network  is  the  Computer 


Purchase  a  subscription  to  the  Java  Enterprise  Developer  Promotion  and  get  a  free  Sun  Fire™  V20z 
AMD  Opteron-based  server  today.2 


Everything  you  need  to  run  your  business.  Email,  instant  messaging,  calendar,  application  server, 
portals,  network  identity,  clustering,  web  server,  security,  enterprise  messaging,  interoperability,  web 
service  delivery,  directory,  firewalls,  streaming  video,  grid  computing  and  more  -  all  for  a  single  price  of 
$  100/employee/year,1  with  an  unlimited  right  to  use.  All-inclusive,  no  hidden  costs.  Software,  service 
and  support  included.  Our  bet  is  that  you  will  never  spend  too  much  on  IT  again. 


THE  BLUEPRINT  IN  THE  BACKGROUND  DEMONSTRATES  THE  WORLD-CUSS 
SOFTWARE  INFRASTRUCTURE  AND  ARCHITECTURE  OF  THE  SUN  JAVA  ENTERPRISE 
SYSTEM.  TODAY,  50  COMPANIES  ARE  USING  THE  JAVA  ENTERPRISE  SYSTEM 
TO  DELIVER  NETWORK  SERVICES  TO  OVER  110.000  ENTERPRISE  EMPLOYEES  AND 
MILLIONS  OF  THEIR  CUSTOMERS  WHILE  SLASHING  IT  COSTS. 


1.  PRICING  IS  U.S.  LIST  PRICE.  ALL  PRICES  ARE  QUOTED  IN  U.S.  DOLLARS.  2.  OFFER  VALID  IN  THE  U.S.  AND  THROUGH  SUN  STORE  ONLY.  PROMOTION  VALID  THROUGH  JUNE  30,  2004.  FOR  A  LIMITED  TIME  ONLY.  GET  THE 
JAVA  ENTERPRISE  DEVELOPER  PROMOTION,  A  VALUE  OF  OVER  U.S.  $7000,  FOR  ONLY  U.S.  $1499  PER  YEAR  FOR  A  3-YEAR  SUBSCRIPTION.  SEE  WEBSITE  FOR  DETAILS. 

c  2004  SUN  MICROSYSTEMS,  INC.  ALL  RIGHTS  RESERVED.  SUN,  SUN  MICROSYSTEMS,  THE  SUN  LOGO,  JAVA,  THE  JAVA  LOGO,  SUN  FIRE  AND  THE  NETWORK  IS  THE  COMPUTER  ARE  TRADEMARKS  OR  REGISTERED 
TRADEMARKS  OF  SUN  MICROSYSTEMS,  INC.  IN  THE  UNITED  STATES  AND  OTHER  COUNTRIES. 


The  right  management  can  put  you  in  control  of  your  infrastructure, 
not  the  other  way  around. 

Unicenter  Infrastructure  Management  Software 

So  long,  mayhem.  Management  is  here.  Unicenter  infrastructure  management  software  gives  you  unparalleled 
control  of  your  IT  environment.  It  lets  your  infrastructure  react  to  changes  in  real  time,  so  your  IT  and  business 
priorities  are  always  in  sync.  Its  self-healing  capabilities  help  you  do  more  with  less  and  control  costs.  To  learn 
how  the  right  management  can  help  you  realize  on-demand  computing  with  your  existing  infrastructure,  or  to  get 
a  white  paper,  go  to  ca.com/infrastructure. 


